CVE-2025-3064

Summary

CVE-2025-3064 is a vulnerability affecting the WPFront User Role Editor plugin for WordPress. Versions up to 4.2.1 are vulnerable due to a missing or incorrect nonce validation issue on the whitelist_options() function. This creates an opportunity for Cross-Site Request Forgery (CSRF) attacks, allowing unauthenticated attackers to update the default role option. Successful exploitation of this vulnerability requires tricking a site administrator into performing a specific action, such as clicking on a link. The risk is heightened for multisite instances.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.