Cross‑Site Request Forgery (CWE‑352) is present in the UsersWP plugin for WordPress. The flaw allows an attacker to trick an authenticated user into initiating requests that the plugin will process, potentially changing user data or performing privileged actions without the user’s knowledge. The experimental CVSS score of 4.3 reflects a moderate impact when an attacker can gain the victim’s authentication state.

Stiofan’s UsersWP plugin, versions from an unspecified earliest release through 1.2.53 inclusive, is affected. The vulnerability is scoped to the plugin’s request handling code rather than the core WordPress installation. Any WordPress site that has the plugin installed at a version ≤ 1.2.53 is potentially exposed.

The CVSS base score of 4.3 indicates that the security loss is moderate; however, the EPSS score of less than 1 percent reveals that the likelihood of observed exploitation is low. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented, widespread exploitation. Attackers would typically require the victim to be logged in and follow a crafted link or be lured to a page that submits a hidden form, which is a commonly employed CSRF attack pattern. No public exploit has yet been reported, but the low probability does not eliminate the risk for high‑value sites.