PT-2026-1588 · WordPress · Latest Registered Users

Abhirup Konwar · Published 2026-01-07 · Updated 2026-02-02 · CVE-2025-13493

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Latest Registered Users plugin for WordPress versions prior to 1.5

Description The Latest Registered Users plugin for WordPress is susceptible to unauthorized user data export. This is a result of a lack of authorization and nonce validation within the rnd handle form submit function, which is connected to the admin post my simple form and admin post nopriv my simple form actions. An unauthenticated attacker can potentially export complete user details (excluding passwords and sensitive tokens) in CSV format by manipulating the action parameter.

Recommendations Update The Latest Registered Users plugin to version 1.5 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13493

Affected Products

Latest Registered Users

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13493 · Security Note
• https://plugins.trac.wordpress.org/browser/latest-registered-users/trunk/latest-registered-users.php#L246 · Note
• https://t.me/CVEtracker/41584 · Telegram Post
• https://twitter.com/RedPacketSec/status/2008927789869670840 · Twitter Post
• https://plugins.trac.wordpress.org/browser/latest-registered-users/trunk/latest-registered-users.php#L66 · Note
• https://twitter.com/DavidMarquet19/status/2018233146538414344 · Twitter Post
• https://plugins.trac.wordpress.org/browser/latest-registered-users/tags/1.4/latest-registered-users.php#L246 · Note
• https://twitter.com/CVEnew/status/2008824746150887701 · Twitter Post
• https://twitter.com/cracbot/status/2010668122840453188 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e6139543-81e3-480a-93a4-1d87b3f3f51e?source=cve · Note