What is CVE-2025-12770?

CVE-2025-12770 is a medium-severity vulnerability in Saadiqbal New User Approve, classified under Information Disclosure. CVSS score: 5.3/10. Published 2025-11-19.

How severe is CVE-2025-12770?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Saadiqbal New User Approve

CVE-2025-12770

The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and including, 3.0.9 due to insufficient API key validation using loose equality comparison. This makes it possible for unauthenticated attackers to retrieve personally identifiable information (PII), including usernames and email addresses of users with various approval statuses via the Zapier REST API endpoints, by exploiting PHP type juggling with the api_key parameter set to "0" on sites where the Zapier API key has not been configured.

Vulnerability class: Information Disclosure

EPSS: 0.003 (21.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Saadiqbal New User Approve — versions 0

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

Frequently asked questions

What is CVE-2025-12770?: CVE-2025-12770 is a medium-severity vulnerability in Saadiqbal New User Approve, classified under Information Disclosure. CVSS score: 5.3/10. Published 2025-11-19.
How severe is CVE-2025-12770?: Medium severity. CVSS v3 base score is 5.3 out of 10.