The WordPress Restrict User Registration plugin contains a CSRF flaw that allows an attacker to submit a crafted request and store malicious JavaScript in the plugin’s data. Once the script is stored, it is executed whenever a site visitor loads the affected page, leading to code execution in the context of the user’s browser. This vulnerability can compromise confidentiality, integrity, and availability for all site users.

The flaw affects the DevriX Restrict User Registration plugin up through version 1.0.1. Any WordPress site that has this plugin installed and not updated to a later release is vulnerable.

The vulnerability carries a CVSS score of 7.1, indicating high severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Likely exploitation requires an attacker to persuade an authenticated user or the site administrator to visit a malicious URL that triggers the CSRF payload.