Simple Registration for WooCommerce Cross-Site Request Forgery Vulnerability in WordPress

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Simple Registration for WooCommerce plugin for WordPress, affecting all versions through 1.5.8. The vulnerability arises from inadequate nonce validation on the role requests admin page handler, located in the includes/display-role-admin.php file. This flaw allows unauthenticated attackers to approve pending role requests and escalate user privileges by sending a forged request, provided they can deceive a site administrator into clicking a link.

Impact

Exploitation of this vulnerability could lead to unauthorized approval of role requests, allowing attackers to escalate privileges on the affected WordPress site.

Remediation

Users are advised to update the Simple Registration for WooCommerce plugin to version 1.5.9 or a newer patched version.