CVE-2025-53444
Cross-Site Request Forgery in Userpro Plugin Before
Publication date: 2026-04-15
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| deluxethemes | userpro | to 5.1.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-53444 is a Cross Site Request Forgery (CSRF) vulnerability affecting the WordPress Userpro Plugin versions prior to 5.1.11.
This vulnerability allows an attacker to trick higher privileged users into executing unwanted actions while authenticated, by having them perform actions such as clicking a malicious link, visiting a crafted page, or submitting a form.
The vulnerability requires user interaction and can be initiated by an unauthenticated attacker but relies on a privileged user’s involvement to be exploited successfully.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to coerce privileged users into performing unauthorized actions on your WordPress site while they are authenticated.
Although the severity is rated low (CVSS score 4.3), such vulnerabilities are often used in mass-exploit campaigns targeting many websites indiscriminately.
If exploited, it could lead to broken access control issues where attackers manipulate site behavior without direct access.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2025-53444 vulnerability, you should update the WordPress Userpro Plugin to version 5.1.11 or later.
This update patches the Cross Site Request Forgery (CSRF) vulnerability that allows attackers to trick privileged users into performing unauthorized actions.
Additionally, consider enabling auto-update options if available to ensure rapid protection against this and similar vulnerabilities.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2025-53444 is a Cross Site Request Forgery (CSRF) vulnerability that allows attackers to trick privileged users into performing unauthorized actions. While the vulnerability has a low severity score (4.3) and is classified under OWASP Top 10 A1: Broken Access Control, it could potentially lead to unauthorized changes or access within affected systems.
Such unauthorized actions could impact compliance with standards and regulations like GDPR or HIPAA if they result in improper handling, modification, or exposure of personal or sensitive data. However, the provided information does not explicitly detail the direct impact on compliance frameworks.
Mitigation by updating to Userpro Plugin version 5.1.11 or later is recommended to reduce the risk of exploitation and help maintain compliance.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue affecting the WordPress Userpro Plugin versions prior to 5.1.11. Detection typically involves verifying the plugin version installed on your WordPress site.
To detect if your system is vulnerable, you should check the installed version of the Userpro plugin. If it is older than 5.1.11, your system is susceptible to this CSRF vulnerability.
There are no specific network commands or signatures provided to detect exploitation attempts of this vulnerability. However, you can use the following commands to check the plugin version on your server:
- Access your WordPress installation directory via SSH.
- Run the command: `grep 'Version' wp-content/plugins/userpro/readme.txt` to find the plugin version.
- Alternatively, check the plugin version from the WordPress admin dashboard under Plugins.
To mitigate the risk, update the Userpro plugin to version 5.1.11 or later.