The Restrict User Registration plugin contains a missing or incorrect nonce check in its update() function, which permits an unauthenticated attacker to send a forged request that modifies the plugin’s configuration settings. By tricking an administrator into clicking a crafted link or submitting a form, the attacker can change the plugin’s behavior, potentially enabling or disabling features, altering registration restrictions, or compromising site security. This represents a medium‑severity CSRF flaw (CWE-352).

WordPress sites using the devrix Restrict User Registration plugin, any version up to and including 1.0.1, are affected. The issue impacts the plugin’s settings page accessed by site administrators. All installations of the plugin before the patched release are vulnerable.

The CVSS base score is 5.3, indicating medium severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, exploitation requires the attacker to convince an administrator to perform an action, which may be feasible through phishing or social engineering. The resulting unauthorized configuration changes could open pathways for further attacks by modifying user registration constraints or enabling undesirable access.