MemberPress versions up to 1.14.1 contain a Cross‑Site Request Forgery flaw that stems from a bypassable nonce verification in the save_profile_fields() function. By omitting the nonce parameter in a crafted request, an unauthenticated attacker can force a logged‑in user to change that user’s email address. This can trigger the password‑reset flow, effectively transporting the attacker control of the target account. The vulnerability therefore allows an attacker to modify critical account information and potentially hijack user access, breaching both integrity and confidentiality.

The affected software is the MemberPress WordPress plugin. All releases through and including memberpress 1.14.1 are vulnerable; version 1.14.2 and later contain the fix.

The flaw receives a CVSS score of 8.8, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to be logged into the WordPress site while the attacker supplies a forged request that purposely omits the nonce field. Once the email address is changed, the attacker can use the normal password‑reset mechanism to retrieve access. Because the check is completely bypassed and the attack path is straightforward, the risk of exploitation is high, especially on sites where users often interact with external links.