CVE-2025-3064 is a CSRF vulnerability in the WPFront User Role Editor plugin for WordPress, affecting all versions up to and including 4.2.1. The root cause is missing or incorrect nonce validation in the whitelist_options() function. This allows an attacker to craft a forged request that, if executed by a site administrator on a multisite instance, can update the default role option and escalate privileges. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can be exploited remotely (AV:N).

Successful exploitation can lead to an attacker changing the default user role on multisite WordPress installations, enabling privilege escalation with high impact on confidentiality, integrity, and availability. This could allow unauthorized administrative access or other elevated permissions, severely compromising the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators of multisite WordPress instances using this plugin should consider disabling the plugin or restricting access to trusted users only. Additionally, educating administrators to avoid clicking on untrusted links can reduce risk.