CVE-2025-12157: WordPress Simple User Capabilities Plugin

CVE-2025-12157 Overview

CVE-2025-12157 is a missing authorization vulnerability [CWE-862] in the Simple User Capabilities plugin for WordPress. The flaw affects all versions up to and including 1.0. The wp_ajax_nopriv_reset_capability AJAX endpoint lacks a capability check, exposing it to unauthenticated requests. Attackers can invoke the endpoint to reset any user's WordPress capabilities without credentials or user interaction.

The issue is tracked under EPSS with a probability of 0.264%. No public exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Unauthenticated attackers can reset the capabilities of any WordPress user, including administrators, degrading site integrity and disrupting role-based access controls.

Affected Products

WordPress Simple User Capabilities plugin, all versions through 1.0
WordPress sites with the plugin activated and reachable over the network
Multisite deployments where the plugin is network-activated

Discovery Timeline

2025-11-04 - CVE-2025-12157 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12157

Vulnerability Analysis

The Simple User Capabilities plugin registers an AJAX action handler bound to the wp_ajax_nopriv_reset_capability hook. WordPress routes wp_ajax_nopriv_* hooks to unauthenticated visitors reaching /wp-admin/admin-ajax.php. The handler resets a target user's capabilities but never verifies the caller's role via current_user_can() and does not validate an authenticated nonce with check_ajax_referer().

Because capability enforcement is absent, any network client can trigger the reset. The action modifies persistent user metadata used by WordPress to authorize privileged actions across the site.

Root Cause

The root cause is a missing authorization check on a state-changing AJAX endpoint. Registering the sensitive action under wp_ajax_nopriv_ exposes it to anonymous callers, and the handler omits both capability and nonce verification. This pattern maps directly to CWE-862: Missing Authorization.

Attack Vector

Exploitation requires only a network path to the target site's admin-ajax.php endpoint. An attacker submits an HTTP POST request specifying the reset_capability action and a target user identifier. The server processes the request without verifying identity or privileges and rewrites the target user's capabilities.

The result is loss of integrity for user role assignments, which can cascade into administrative disruption and denial of privileged functionality for legitimate operators. See the Wordfence Vulnerability Report and the WordPress Plugin File for the vulnerable handler.

Detection Methods for CVE-2025-12157

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=reset_capability originating from unauthenticated sessions.
Unexpected changes to the wp_capabilities user meta key for one or more accounts.
Users reporting sudden loss of dashboard access or missing role assignments in wp_usermeta.

Detection Strategies

Alert on any admin-ajax.php request where action=reset_capability is present without a valid authenticated session cookie.
Correlate WordPress audit logs against database changes to the wp_usermeta table for the wp_capabilities key.
Baseline the plugins active on managed WordPress hosts and flag installations of simple-user-capabilities at version 1.0 or lower.

Monitoring Recommendations

Forward web server access logs and WordPress application logs to a centralized log platform for retention and search.
Enable a WordPress activity plugin that records role and capability changes with the initiating IP and user context.
Track anomalous traffic spikes to admin-ajax.php from external sources, particularly with nopriv action names.

How to Mitigate CVE-2025-12157

Immediate Actions Required

Deactivate and remove the Simple User Capabilities plugin until a patched version is released and verified.
Audit all WordPress user accounts and restore expected roles where wp_capabilities has been altered.
Block unauthenticated POST requests to admin-ajax.php containing action=reset_capability at the web application firewall.

Patch Information

At the time of the NVD entry, no fixed version of the Simple User Capabilities plugin has been published. Monitor the WordPress Plugin Page and the Wordfence Vulnerability Report for release updates. Apply any vendor patch as soon as it becomes available and re-test user role integrity after deployment.

Workarounds

Remove the plugin directory from wp-content/plugins/simple-user-capabilities/ to eliminate the vulnerable AJAX hook.
Restrict access to /wp-admin/admin-ajax.php for unauthenticated traffic where site functionality permits.
Deploy a WAF rule that inspects request bodies and denies action=reset_capability without a valid nonce.

bash

# Example WAF rule (ModSecurity) to block the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1012157,\
     msg:'Block CVE-2025-12157 reset_capability abuse'"
    SecRule ARGS:action "@streq reset_capability" \
        "t:none,t:lowercase"