Cross-Site Request Forgery Vulnerability in User Registration Plugin for WordPress
CVE-2025-3284
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 April 2025
What is CVE-2025-3284?
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery due to inadequate nonce validation in the user_registration_pro_delete_account() function. This weakness allows unauthenticated attackers to issue malicious requests that can delete user accounts, including those of administrators, by tricking a site administrator into clicking a specially crafted link.
Affected Version(s)
User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin * <= 5.1.3