CVE-2026-25015: CSRF in UsersWP WordPress Plugin

The CSRF vulnerability in UsersWP allows an attacker to execute actions on behalf of an authenticated user without their knowledge. This could include modifying user roles, deleting users, or altering plugin settings. The impact is directly tied to the permissions of the user being impersonated. An attacker could gain administrative access if they can trick an administrator into performing a malicious action. The blast radius is limited to the UsersWP plugin's functionality and the WordPress site itself, but successful exploitation could compromise the entire site if administrative actions are affected.

1. Reserved2026-01-28
2. Published2026-02-03
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-25015 is to immediately upgrade the UsersWP plugin to version 1.2.54 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, ensure that users are educated about the risks of clicking on suspicious links or visiting untrusted websites. While not a direct fix, enabling WordPress's core CSRF protection can offer a layer of defense. After upgrading, verify the plugin's functionality and user roles to ensure no unauthorized changes have occurred.

Active installs

20KKnown

Plugin rating