What the vulnerability does
01Description
The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the "Import Using CSV File" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
User Generator and Importer versions 1.2.2 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions such as creating users, modifying settings, or deleting data without the administrator's knowledge or consent.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions (create users, modify settings, delete data) on behalf of a logged-in administrator.
Potential impact on your site
04Site Impact
Attackers can compromise user accounts, alter site configuration, or cause data loss if an admin visits a malicious link while logged in.
Conditions required to exploit
05Prerequisites
Administrator must be logged in and visit a malicious webpage controlled by the attacker.
Key dates
06Disclosure timeline
December 5, 2025
CVE published
April 8, 2026
Record updated
