CVE-2025-12158 — Vulnerability intelligence

tanvirahmed1984 — Simple User Capabilities

Published: 2025-11-04T04:27:22.881Z

CVSS

9.8

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator.

Sources

• CVE-2025-12158
• Original advisory
• Original advisory
• Original advisory
• CVE-2025-12158