PT-2026-1761 · WordPress · User Registration & Membership – Custom Registration Form Builder

Youcef Hamdani · Published 2026-01-10 · Updated 2026-01-10 · CVE-2025-14976

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin versions prior to 4.4.9

Description The plugin is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is caused by inadequate nonce validation within the process row actions function when handling the 'delete' action. Successful exploitation could allow unauthenticated attackers to delete arbitrary posts by deceiving a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin to version 4.4.9 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14976

Affected Products

User Registration & Membership – Custom Registration Form Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14976 · Security Note
• https://t.me/cveNotify/148349 · Telegram Post
• https://twitter.com/CVEnew/status/2009910330475069734 · Twitter Post
• https://plugins.trac.wordpress.org/browser/user-registration/tags/4.4.8/includes/abstracts/abstract-ur-list-table.php#L290 · Note
• https://plugins.trac.wordpress.org/changeset/3435099/user-registration · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e5495b4c-a1ac-4860-83a7-686d9436d983?source=cve · Note
• https://t.me/CVEtracker/41935 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009966553626706089 · Twitter Post