Cross-Site Request Forgery Vulnerability in Restrict User Registration Plugin by WordPress

CVE-2025-9892

What is CVE-2025-9892?

The Restrict User Registration plugin for WordPress exposes a vulnerability due to inadequate nonce validation on its update() function. This allows unauthenticated attackers to manipulate plugin settings by sending forged requests if they can deceive a site administrator into executing specific actions, like clicking a malicious link. This weakness underscores the necessity for robust verification mechanisms in plugin development to ensure application integrity.

References