Skip to content
Sign in
5.3 Medium

CVE-2025-9892 The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,…

Description

The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the update() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products and versions

Product Affected versions Fixed in
Restrict User Registration 1.0 earliest → 1.0.1 No fix stated

Other CVEs of Restrict User Registration

The 2 CVEs of Restrict User Registration →
CVE-2025-32655 Cross-Site Request Forgery (CSRF) vulnerability in DevriX Restrict User Registration restrict-user-registration allows… 7.1 High
Track this CVE