Asgaros Forum, CVE-2025-12901

CVE, Research URL: CVE-2025-12901
Home page URL: Security reports for Asgaros Forum
Application: Asgaros Forum
Published on: Nov 12, 2025
Research Description: The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.
Affected versions: max 3.3.0.
Status: vulnerable