CVE-2026-1644: 
WordPress vulnerability analysis and mitigation

CVE-2026-1644 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Frontend Profile plugin for WordPress. It affects all versions up to and including 1.3.8, and was published on March 7, 2026, with the assigner being Wordfence. The flaw allows unauthenticated attackers to approve or reject user account registrations by tricking an administrator into clicking a malicious link. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, ENISA EUVD).

The root cause is missing nonce validation on the update_action function within the plugin's wpfep-functions.php file (CWE-352: Cross-Site Request Forgery). Because no CSRF token is verified before processing account approval or rejection actions, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator (e.g., via a malicious link), performs unauthorized user registration management operations. The vulnerable code path is visible in the plugin's source at line 987 of wpfep-functions.php (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to manipulate user account registration states — approving or rejecting pending registrations — without authorization. The integrity impact is low and scoped to the affected WordPress site's user management functionality; there is no confidentiality or availability impact. This could be abused to grant unauthorized users access to a site or to deny legitimate users access, depending on the attacker's objective (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1644. The EPSS score is extremely low at 0.000050, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering an administrator, which limits its practical attack surface (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the WP Frontend Profile plugin version 1.3.8 or earlier with user registration approval enabled.
2. Craft forged request: Construct a malicious URL or HTML page containing a hidden form that submits a POST request to the target site's update_action endpoint (e.g., the admin-facing registration management page), with parameters set to approve or reject a specific user account.
3. Social engineering: Deliver the malicious link or page to a logged-in WordPress administrator via phishing email, comment, or other communication channel.
4. Trigger action: When the administrator clicks the link or visits the page, their browser automatically submits the forged request with their authenticated session cookies, causing the plugin to approve or reject the targeted user registration without nonce validation (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST requests to the update_action endpoint from unusual referrer URLs or external domains, particularly when correlated with administrator sessions.
• Application: Unexpected changes in user account registration statuses (approvals or rejections) not initiated by the administrator through the normal dashboard workflow.
• Network: Requests to the registration management endpoint originating from external or unfamiliar IP addresses coinciding with an administrator's active session.

Users should update the WP Frontend Profile plugin to a version beyond 1.3.8 that includes nonce validation on the update_action function. The fix is available in the plugin's trunk as reflected in the WordPress plugin repository changeset (WordPress Trac Changeset). As a temporary workaround, administrators should exercise caution when clicking links in emails or messages, and consider disabling the user registration approval feature until the plugin is updated (Wordfence).

The vulnerability was reported by Wordfence and received routine coverage from automated CVE tracking services and vulnerability databases. No notable researcher commentary or significant media coverage has been identified beyond standard disclosure channels (Wordfence).