Description
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticated attackers to force delete users, including administrators, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2025-04-19
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted user deletion via CSRF
Action: Apply Patch
AI Analysis

Impact

The User Registration PRO plugin allows unauthenticated attackers to delete any user, including administrators, because it lacks proper nonce validation in the user_registration_pro_delete_account() function. The flaw is a classic Cross‑Site Request Forgery that can be triggered by sending a forged request to the deletion endpoint.

Affected Systems

WPEverest User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin versions 5.1.3 and earlier are affected.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate risk and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack likely requires the victim to click a crafted link or submit a forged form to the vulnerable endpoint, which then processes the deletion without verifying the requester’s intent or authenticity.

Generated by OpenCVE AI on April 22, 2026 at 01:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the User Registration PRO plugin to version 5.1.4 or later.
  • Add a custom code snippet to enforce nonce verification before executing the user deletion function to mitigate CSRF attacks until the official patch is applied.
  • Conduct an audit of user accounts to detect any undeclared deletions and restore affected accounts from backup if necessary.

Generated by OpenCVE AI on April 22, 2026 at 01:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-11921 The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticated attackers to force delete users, including administrators, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
History

Mon, 21 Apr 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 19 Apr 2025 02:45:00 +0000

Type Values Removed Values Added
Description The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticated attackers to force delete users, including administrators, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Title User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:49:44.307Z

Reserved: 2025-04-04T15:33:23.745Z

Link: CVE-2025-3284

cve-icon Vulnrichment

Updated: 2025-04-21T14:16:06.564Z

cve-icon NVD

Status : Deferred

Published: 2025-04-19T03:15:13.870

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-3284

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T01:45:05Z

Weaknesses