CVE-2025-14976

CVE-2025-14976 describes a Cross-Site Request Forgery (CSRF) vulnerability in the User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress, affecting all versions up to and including 4.4.8. This flaw stems from insufficient nonce validation within the 'process_row_actions' function when handling the 'delete' action. An unauthenticated attacker could exploit this by tricking a logged-in administrator into clicking a malicious link, leading to the deletion of arbitrary posts. The vulnerability carries a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low impact to integrity and availability. While the attack vector is remote, successful exploitation relies on social engineering. Currently, there is no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or Nuclei modules. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or immediate concern.