CVE-2025-12879 is a CSRF vulnerability in the User Generator and Importer plugin for WordPress, affecting versions up to and including 1.2.2. The vulnerability arises from the lack of nonce validation in the 'Import Using CSV File' feature, enabling attackers to craft malicious requests that, when performed by an authenticated administrator, result in the creation of arbitrary administrator accounts. This elevates privileges without requiring direct authentication by the attacker. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to escalate privileges by creating administrator accounts on the affected WordPress site. This can lead to complete site compromise, including unauthorized access, data manipulation, and potential disruption of service. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Administrators should exercise caution with the User Generator and Importer plugin, especially avoiding clicking on untrusted links or performing CSV imports from unverified sources. Monitor the vendor's advisory channels for updates or patches. Consider disabling or removing the plugin until a fix is released.