The UsersWP plugin contains a Cross‑Site Request Forgery weakness that allows a malicious actor to perform actions on behalf of an authenticated user without their consent. By crafting a forged HTTP request that includes the target user’s session cookie, an attacker can trigger plugin functions that may alter user data or settings. The primary impact is unauthorized actions performed with the privileges of the logged‑in user, potentially compromising account integrity and confidentiality.

The vulnerability affects the Stiofan UsersWP plugin on WordPress sites running any version up through 1.2.48. Sites that have installed or are still using this range of versions are at risk; versions newer than 1.2.48 are not impacted.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is expected to be rare. The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is a cross‑site request that an attacker can force a legitimate user’s browser to send when the user is authenticated. The weakness is a classic CSRF flaw (CWE‑352) and typically requires social engineering to persuade the user to visit a malicious site or click a crafted link.