CVE-2025-12770: WordPress New User Approve Plugin Flaw

CVE-2025-12770 Overview

CVE-2025-12770 affects the New User Approve plugin for WordPress in all versions up to and including 3.0.9. The vulnerability stems from insufficient API key validation in the Zapier REST API endpoints. The plugin uses PHP loose equality comparison (==) instead of strict comparison, enabling PHP type juggling attacks. Unauthenticated attackers can retrieve personally identifiable information (PII), including usernames and email addresses of users with various approval statuses, by supplying the api_key parameter with the value "0" on sites where the Zapier API key has not been configured. The issue is classified under [CWE-200] Information Exposure.

Critical Impact
Unauthenticated remote attackers can extract WordPress user PII (usernames and email addresses) from vulnerable sites where the Zapier integration was not configured.

Affected Products

WordPress New User Approve plugin versions up to and including 3.0.9
Sites running the plugin with the Zapier API key left unconfigured
WordPress installations exposing the plugin's Zapier REST API endpoints

Discovery Timeline

2025-11-19 - CVE-2025-12770 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12770

Vulnerability Analysis

The New User Approve plugin exposes REST API endpoints under its Zapier integration to allow external automation to query user approval data. Access control on these endpoints depends on an api_key query parameter that the plugin compares against the stored Zapier API key. The comparison uses PHP loose equality, which triggers implicit type conversion between operands of different types.

When the site administrator has not configured the Zapier API key, the stored value is an empty string or null. In PHP, the loose comparison "0" == "" evaluates to false in modern PHP versions, but comparisons involving null and empty strings, or numeric string coercion, can yield unexpected true results. Attackers supplying api_key=0 bypass the check on unconfigured installations and reach the protected endpoints. The endpoints then return user records containing usernames and email addresses across approval states (pending, approved, denied).

Root Cause

The root cause is the use of PHP loose equality (==) rather than strict equality (===) when validating the api_key request parameter in includes/zapier/includes/rest-api.php. Loose comparison enables type juggling, allowing crafted string values to match unset or empty stored keys. See the WordPress New User Approve source at line 104 and line 40 for the affected validation logic.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker issues an HTTP GET request to the plugin's Zapier REST API endpoint with the query parameter api_key=0. No authentication, credentials, or user interaction is required. The endpoint responds with JSON containing user records if the site has the plugin installed and the Zapier API key remains unset. Refer to the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-12770

Indicators of Compromise

HTTP requests to WordPress REST routes under the new-user-approve or zapier namespaces containing api_key=0
Unusual outbound JSON responses from /wp-json/ endpoints containing bulk user email addresses
Access log entries with unauthenticated clients hitting Zapier integration endpoints on sites where Zapier automation is not in use

Detection Strategies

Inspect WordPress access logs for requests to the plugin's Zapier REST API paths with api_key values of 0, empty, or numeric strings
Review installed plugin inventory for new-user-approve at version 3.0.9 or earlier
Correlate REST API responses of unusual size or user-record content with unauthenticated source IPs

Monitoring Recommendations

Enable WordPress REST API request logging and forward logs to a centralized analytics platform
Alert on repeated unauthenticated requests to /wp-json/ endpoints originating from a single source IP
Monitor for anomalous data egress patterns from WordPress hosts, particularly JSON payloads containing multiple user email addresses

How to Mitigate CVE-2025-12770

Immediate Actions Required

Update the New User Approve plugin to a version later than 3.0.9 as soon as a patched release is available
Configure a strong, non-empty Zapier API key inside the plugin settings even if the Zapier integration is not used
Restrict access to the WordPress REST API from untrusted networks using a web application firewall (WAF)

Patch Information

At the time of CVE publication, users should monitor the WordPress plugin repository and the Wordfence advisory for the fixed version. The patch replaces loose equality with strict equality comparison and rejects empty or unset stored API keys.

Workarounds

Deactivate the New User Approve plugin until a patched version is installed if the Zapier integration is not required
Deploy WAF rules that block requests to the plugin's Zapier REST endpoints where api_key equals 0 or is missing
Set a random, high-entropy value for the Zapier API key in the plugin settings to prevent the type juggling bypass

bash

# Example WAF rule (ModSecurity) to block the exploitation pattern
SecRule REQUEST_URI "@contains /wp-json/new-user-approve" \
    "chain,deny,status:403,id:1012770,msg:'Block CVE-2025-12770 type juggling'"
    SecRule ARGS:api_key "@rx ^(0|)$" "t:none"