Platform
wordpress
Component
wp-front-end-profile
Fixed in
1.3.9
CVE-2026-1644 describes a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP Frontend Profile plugin for WordPress. This flaw allows unauthenticated attackers to potentially manipulate user account registrations by tricking administrators into performing actions. The vulnerability impacts versions 0.0.0 through 1.3.8, and a patch is available in version 1.3.9.
The core of this vulnerability lies in the absence of proper nonce validation within the 'update_action' function of the plugin. A CSRF attack exploits this by crafting malicious requests that appear to originate from a legitimate user. An attacker could, for example, create a link containing a forged request to approve or reject a user registration. If an administrator clicks this link, the plugin will execute the request without verifying the user's authorization, potentially granting or denying access to a user account without their consent. This could lead to unauthorized account creation or denial of service for legitimate users attempting to register.
CVE-2026-1644 was publicly disclosed on 2026-03-06. There are currently no known public proof-of-concept exploits available. The vulnerability is not listed on the CISA KEV catalog as of this writing. The medium CVSS score reflects the potential for unauthorized account manipulation, but the requirement for administrator interaction limits the immediate exploitability.
Exploit Status
EPSS
0.01% (0% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-1644 is to immediately upgrade the WP Frontend Profile plugin to version 1.3.9 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out suspicious requests targeting the 'update_action' endpoint. Specifically, look for requests lacking proper CSRF tokens. Additionally, educate administrators about the risks of clicking on links from untrusted sources and encourage them to carefully review all actions before confirming them. Regularly scan your WordPress installation for outdated plugins using a security plugin.
Update to version 1.3.9, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-1644 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Frontend Profile WordPress plugin, allowing attackers to manipulate user registrations.
You are affected if you are using WP Frontend Profile versions 0.0.0 through 1.3.8. Upgrade to 1.3.9 or later to mitigate the risk.
Upgrade the WP Frontend Profile plugin to version 1.3.9 or later. Consider WAF rules as a temporary workaround if upgrading is not immediately possible.
As of now, there are no confirmed reports of active exploitation, but the vulnerability is publicly known.
Refer to the WP Frontend Profile plugin's official website or WordPress plugin repository for the latest security advisories and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.