Technical impact
The Latest Registered Users plugin for WordPress allows unauthenticated users to trigger a data export that outputs all registered user details in CSV format. The vulnerability arises from missing authorization checks and nonce validation in the rnd_handle_form_submit function, which is called through both admin_post_my_simple_form and admin_post_nopriv_my_simple_form actions. Although passwords and sensitive tokens are omitted, the exposed data (user names, emails, registration dates, etc.) can still compromise privacy and may aid phishing or credential‑stuffing attacks. This flaw is identified as a missing authorization vulnerability (CWE‑862).
Affected Systems
Any WordPress installation that includes the Latest Registered Users plugin in version 1.4 or earlier is affected. Site administrators must review the plugin version in use and identify any instances of these vulnerable releases across their sites.
Risk and Exploitability
The CVSS score of 7.5 indicates a high potential impact if exploited, yet the EPSS score of less than 1% suggests that the likelihood of real‑world exploitation is currently low. The flaw is not listed in CISA’s KEV catalog. A threat actor can achieve the data export simply by sending an unauthenticated POST request to the plugin’s action endpoint with the appropriate parameters, requiring no user privileges or login credentials.
