CVE-2025-13493

Name of the Vulnerable Software and Affected Versions The Latest Registered Users plugin for WordPress versions prior to 1.5

Description The Latest Registered Users plugin for WordPress is susceptible to unauthorized user data export. This is a result of a lack of authorization and nonce validation within the rnd handle form submit function, which is connected to the admin post my simple form and admin post nopriv my simple form actions. An unauthenticated attacker can potentially export complete user details (excluding passwords and sensitive tokens) in CSV format by manipulating the action parameter.

Recommendations Update The Latest Registered Users plugin to version 1.5 or later.