CVE-2025-14976

Name of the Vulnerable Software and Affected Versions User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin versions prior to 4.4.9

Description The plugin is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is caused by inadequate nonce validation within the process row actions function when handling the 'delete' action. Successful exploitation could allow unauthenticated attackers to delete arbitrary posts by deceiving a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin to version 4.4.9 or later.