{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-30T04:18:38.953","vulnerabilities":[{"cve":{"id":"CVE-2025-13493","sourceIdentifier":"security@wordfence.com","published":"2026-01-07T12:16:48.030","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missing authorization and nonce validation in the rnd_handle_form_submit function hooked to both admin_post_my_simple_form and admin_post_nopriv_my_simple_form actions. This makes it possible for unauthenticated attackers to export complete user details (excluding passwords and sensitive tokens) in CSV format via the 'action' parameter."},{"lang":"es","value":"El plugin Latest Registered Users para WordPress es vulnerable a la exportación no autorizada de datos de usuario en todas las versiones hasta la 1.4, inclusive. Esto se debe a la falta de autorización y validación de nonce en la función rnd_handle_form_submit, enganchada a las acciones admin_post_my_simple_form y admin_post_nopriv_my_simple_form. Esto permite a atacantes no autenticados exportar detalles completos de usuario (excluyendo contraseñas y tokens sensibles) en formato CSV a través del parámetro 'action'."}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/latest-registered-users/tags/1.4/latest-registered-users.php#L246","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/latest-registered-users/trunk/latest-registered-users.php#L246","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/latest-registered-users/trunk/latest-registered-users.php#L66","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6139543-81e3-480a-93a4-1d87b3f3f51e?source=cve","source":"security@wordfence.com"}]}}]}