The User Registration & Membership plugin for WordPress is vulnerable to a CSRF flaw caused by missing or incorrect nonce validation in the 'process_row_actions' function for the 'delete' action. This flaw permits an attacker to create a forged request that, when executed by a site administrator, will delete any post the admin has permission to delete. The impact is a loss of content integrity and potential availability disruption if critical posts are removed. The weakness is categorized as CWE‑352, indicating an improper defensive measure against cross‑site request forgery.

All WordPress sites running the User Registration & Membership plugin up to and including version 4.4.8 are affected. This includes installations with the free and paid membership features, subscription management, content restriction, user profile, and custom registration or login builder functionality provided by the wpeverest plugin.

The CVSS score of 5.4 places the vulnerability in the moderate severity range. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability is not listed on the CISA KEV catalog. Attackers would need to entice a site administrator to visit a crafted URL or click a malicious link in order to trigger the deletion. The known exploit path relies on CSRF; no additional privileges or code execution are required, making it a simple yet potentially damaging attack vector for sites that frequently publish valuable content.