Unpatched CSRF flaw in plugin with no fix date
Plugin is reported to have an unpatched cross-site request forgery flaw, with no fix date.
Tier I · Proven The best-established problems.
6 public reports · first reported 13 December 2025 · last reported 3 February 2026
What's going wrong
Site owners using this WordPress user approval plugin report that security scanners and hosting providers flagged a cross-site request forgery weakness in older versions. Several reviewers repeatedly asked for a fix date after a later update did not close the issue. One host warned that the flaw could let an attacker add administrators. Site owners who run membership or client sites are left without a clear path to safety, and must choose between keeping an exposed plugin and removing it. The opportunity is a monitoring and alert service that tracks the advisory, states the exposure for each site, and recommends a safe interim step.
AI-assisted: written with the help of AI from the reports.
Products affected
New User Approve.
Related problems
Who has this problem
1 business found.
Unlock them at the top of this page — $19.
All sales are final — no refunds.
Each business's name, the address it published, and the page it was published on. Paid through Stripe; you get a private page to bookmark, with a CSV download.