A cross‑site request forgery flaw in DeluxeThemes Userpro permits an attacker to trick a logged‑in site visitor into submitting a forged request that bypasses normal authorization checks, allowing the attacker to perform privileged actions such as changing account settings or posting content. The vulnerability is classified as CWE‑352 and carries a CVSS score of 4.3, indicating moderate impact if exploited.

The flaw exists in all versions of the Userpro plugin for WordPress older than 5.1.11. All sites running Userpro prior to this release are exposed, regardless of WordPress version or server configuration, because the plugin itself performs insufficient token validation on form submissions.

The exploit requires that the victim be authenticated to the site and that the attacker can embed a malicious request within a site the victim visits, typically by hosting a malicious image or script. The lack of an EPSS score and the fact that the vulnerability is not listed in the KEV catalog suggest it has not yet seen widespread exploitation. However, the moderate CVSS rating and the ease of creating CSRF requests mean that once discovered, the flaw could affect any vulnerable WordPress site quickly. Site operators who leave the plugin at a vulnerable version are at moderate to high risk if they have active user accounts with elevated privileges.