CVE-2025-13493: 
WordPress vulnerability analysis and mitigation

CVE-2025-13493 is an unauthorized user data export vulnerability in the Latest Registered Users plugin for WordPress, affecting all versions up to and including 1.4. The flaw allows unauthenticated attackers to export complete WordPress user details (excluding passwords and sensitive tokens) in CSV format. It was disclosed on January 7, 2026, by Wordfence. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, Red Hat CVE).

The root cause is Missing Authorization (CWE-862) combined with absent nonce validation in the rnd_handle_form_submit function. This function is hooked to both the admin_post_my_simple_form and admin_post_nopriv_my_simple_form WordPress actions — the latter of which is explicitly accessible to unauthenticated users. Because no capability check or nonce is enforced, any unauthenticated HTTP request supplying the appropriate action parameter can trigger a full CSV export of registered user data. The vulnerable code path is visible in the plugin source at line 246 of latest-registered-users.php (Wordfence, Plugin Source).

Successful exploitation results in a high confidentiality impact: an unauthenticated attacker can obtain a complete export of all registered WordPress user records — including usernames, email addresses, registration dates, and other profile metadata — in CSV format. While passwords and sensitive authentication tokens are excluded, the exposed data (particularly email addresses and usernames) can be leveraged for phishing campaigns, credential stuffing, or targeted social engineering attacks. There is no integrity or availability impact, but the bulk exposure of user PII at scale represents a significant data breach risk for affected WordPress sites (Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.03%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and no special configuration, making it trivially exploitable by any attacker who identifies a vulnerable site (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Latest Registered Users plugin (version ≤ 1.4) using passive techniques such as searching for the plugin's readme file at /wp-content/plugins/latest-registered-users/readme.txt, or using tools like WPScan.
2. Craft the malicious request: Send an unauthenticated HTTP POST request to the target site's WordPress admin-post endpoint: https://target.com/wp-admin/admin-post.php with the body parameter action=my_simple_form.
3. Trigger the export: Because the admin_post_nopriv_my_simple_form action is registered without authorization or nonce checks, the server processes the request and invokes rnd_handle_form_submit.
4. Receive CSV output: The server responds with a CSV file containing complete user records (usernames, email addresses, registration metadata, and other profile fields) for all registered users on the site.
5. Leverage harvested data: Use the exported email addresses and usernames for downstream attacks such as phishing, credential stuffing against other services, or targeted spam campaigns (Wordfence, Plugin Source).

• Network: Unauthenticated HTTP POST requests to /wp-admin/admin-post.php with the body parameter action=my_simple_form from unexpected or external IP addresses; large CSV responses served from the WordPress admin-post endpoint to unauthenticated clients.
• Logs: Web server access logs showing POST /wp-admin/admin-post.php with action=my_simple_form from IPs with no prior authenticated session; repeated requests from the same IP in a short timeframe suggesting automated scanning.
• Application: WordPress debug or error logs referencing the rnd_handle_form_submit function being invoked outside of an authenticated admin context.

Users should update the Latest Registered Users plugin to version 1.5 or later, which addresses the missing authorization and nonce validation issues. If an immediate update is not possible, site administrators can temporarily deactivate the plugin to eliminate the attack surface. Additionally, a web application firewall (WAF) rule blocking unauthenticated POST requests to /wp-admin/admin-post.php with action=my_simple_form can serve as a short-term mitigation (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for January 5–11, 2026 (Wordfence Weekly Report). The vulnerability received brief coverage from security aggregators including RedPacketSecurity on Mastodon and TheHackerWire, reflecting routine community awareness rather than significant alarm. No major vendor statements or notable researcher commentary beyond the initial Wordfence disclosure have been identified.