The flaw is a CSRF vulnerability that allows an unauthenticated attacker to craft a request that forces a logged‑in administrator to approve or deny user registrations. By exploiting the missing nonce validation in the trigger_bulk_action function, the attacker can trigger bulk actions without the attacker’s own authentication token. This may lead to unwanted account approvals or denials, effectively allowing the attacker to lock out legitimate users or grant privileges without an administrator’s intent. The weakness aligns with CWE-352.

The vulnerability affects the WordPress plugin User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder for all versions up to and including 5.2.8. Any WordPress installation deploying this plugin and having an administrator role is potentially exposed.

The CVSS score is 4.3, indicating a moderate impact. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The attack can be carried out from the public internet by an unauthenticated user who can trick an administrator into clicking a malicious link or form that submits a forged request to the trigger_bulk_action endpoint. Because the attacker does not need to authenticate, the required conditions for exploitation are minimal—any site with the vulnerable plugin and administrators who are exposed to potential phishing can be affected.