CVE-2025-13493
Published: 07 January 2026
Summary
CVE-2025-13493 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-13493 is a vulnerability in the Latest Registered Users plugin for WordPress, affecting all versions up to and including 1.4. It stems from missing authorization checks and nonce validation in the rnd_handle_form_submit function, which is hooked to the admin_post_my_simple_form and admin_post_nopriv_my_simple_form actions. This flaw, classified under CWE-862 (Missing Authorization), has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no integrity or availability disruption.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction by sending a crafted request with the 'action' parameter to the affected admin post endpoints. Successful exploitation allows export of complete user details—excluding passwords and sensitive tokens—in CSV format, potentially exposing personal data such as usernames, emails, and registration details across the site.
Advisories, including the Wordfence threat intelligence report and WordPress plugin trac browser links, reference specific vulnerable code lines (e.g., lines 246 and 66 in latest-registered-users.php), enabling security teams to verify the issue and apply fixes from updated plugin versions beyond 1.4.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1340
Vulnerability details
The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missing authorization and nonce validation in the rnd_handle_form_submit function hooked to both admin_post_my_simple_form and…
more
admin_post_nopriv_my_simple_form actions. This makes it possible for unauthenticated attackers to export complete user details (excluding passwords and sensitive tokens) in CSV format via the 'action' parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization on public admin_post endpoints in WordPress plugin directly enables remote unauthenticated exploitation of a public-facing web application to access/export sensitive data.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 explicitly limits and documents permitted actions without identification or authentication, directly preventing unauthenticated export of user data via the vulnerable admin_post endpoints.
AC-3 enforces approved access authorizations in the system, addressing the missing authorization checks in rnd_handle_form_submit that enable unauthorized user data export.
AC-6 implements least privilege, ensuring the user data export function requires appropriate privileges rather than allowing unauthenticated access.