{"id":"CVE-2025-12901","aliases":["EUVD-2025-119996","GHSA-jww7-hq4m-9wq6"],"status":"published","title":"Asgaros Forum \u003c= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update","description":"The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00167,"percentile":0.06019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2025-11-12T04:29:09Z","modified":"2026-10-28T02:30:57Z","products":[{"vendor":"asgaros","product":"asgaros forum"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75625e6e-f75b-4e11-acd8-7388efb12b29?source=cve","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/asgaros-forum/tags/3.2.1/includes/forum-notifications.php#L606","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/asgaros-forum/tags/3.2.1/includes/forum-notifications.php#L605","tags":["web"]},{"url":"https://github.com/Asgaros/asgaros-forum/commit/92305fb8ba4ec0a6c65256915d0a32e5553b74f3","tags":["fix"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3392004%40asgaros-forum\u0026new=3392004%40asgaros-forum\u0026sfp_email=\u0026sfph_mail=","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12901","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jww7-hq4m-9wq6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12901.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-12901","title":"Asgaros Forum \u003c= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update","description":"The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.","status":"published","published":"2025-11-12T04:29:09.846Z","modified":"2026-04-08T17:01:20.293Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:41.743125Z"}],"euvd":[{"id":"EUVD-2025-119996","description":"The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.","status":"published","published":"2025-11-12T04:29:09Z","modified":"2026-04-08T17:01:20Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:53.403695Z"}],"ghsa":[{"id":"GHSA-jww7-hq4m-9wq6","title":"The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all...","description":"The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.","status":"published","published":"2025-11-12T06:30:24Z","modified":"2025-11-12T06:30:30Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:04:45.782037Z"}],"nvd":[{"id":"CVE-2025-12901","description":"The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.","status":"published","published":"2025-11-12T05:15:43.787Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:11:43.650381Z"}],"osv":[{"id":"CVE-2025-12901","title":"Asgaros Forum \u003c= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update","description":"The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.","status":"published","published":"2025-11-12T04:29:09.846Z","modified":"2026-10-28T02:30:57.69694236Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:46.024537Z"}]}}