CVE-2025-12879

Name of the Vulnerable Software and Affected Versions User Generator and Importer plugin for WordPress versions up to and including 1.2.2

Description The plugin is susceptible to Cross-Site Request Forgery due to missing nonce validation in the "Import Using CSV File" function. This allows unauthenticated attackers to potentially create arbitrary accounts with administrator privileges by forging a request, if they can trick a site administrator into performing an action. The Import Using CSV File function lacks proper validation, enabling this issue.

Recommendations Update the User Generator and Importer plugin to a version newer than 1.2.2.