WordPress User Referral Vulnerabilities