CVE-2025-12157 affects the Simple User Capabilities WordPress plugin by allowing unauthorized modification of user capabilities through the 'wp_ajax_nopriv_reset_capability' AJAX endpoint. The vulnerability arises from the absence of a capability check, enabling unauthenticated attackers to reset capabilities for any user. This issue impacts all versions up to and including 1.0 of the plugin. The CVSS 3.1 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official fix has been documented in the provided data.

An attacker without authentication can reset user capabilities arbitrarily, potentially disrupting user permissions and access controls within the affected WordPress site. This could lead to privilege changes or denial of expected user capabilities. However, the vulnerability does not directly impact confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable AJAX endpoint or disabling the plugin if feasible to prevent exploitation.