Member Approval <= 131109 is vulnerable to CSRF

Unauthenticated

Published
2014-05-22

Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to wp-admin/options-general.php.

CVE

https://www.cve.org/CVERecord?id=CVE-2014-3850

CVSS

Score:6.1

Severity:Medium

Version: 131109

There is a patch available in v131110 and we strongly recommend you update to this version as soon as possible.