Security Advisory
CVE-2025-12158
9.8
CRITICAL
Vulnerability Description
The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator.
Published Date
November 4, 2025
Official Source
NIST NVD Advisory