What the vulnerability does
01Description
The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missing authorization and nonce validation in the rnd_handle_form_submit function hooked to both admin_post_my_simple_form and admin_post_nopriv_my_simple_form actions. This makes it possible for unauthenticated attackers to export complete user details (excluding passwords and sensitive tokens) in CSV format via the 'action' parameter.
Explanation of Vulnerability in Simple Terms
02Summary
The Latest Registered Users plugin for WordPress contains a missing authorization flaw that allows unauthenticated attackers to read sensitive user data. The vulnerability affects all versions up to 1.4. An attacker can access the plugin's functionality without logging in, exposing information about recently registered users. Site administrators should update to a version newer than 1.4 immediately.
What an attacker can do
03Attacker Capabilities
Read sensitive information about registered users without logging in.
Potential impact on your site
04Site Impact
User registration data and profiles become publicly visible to anyone on the internet.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 7, 2026
CVE published
April 8, 2026
Record updated
