Restrict User Registration WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Restrict User Registration plugin for WordPress, affecting all versions through 1.0.1. The vulnerability arises from inadequate nonce validation in the update() function, allowing unauthenticated attackers to manipulate the plugin's settings by sending a forged request, provided they can deceive a site administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for unauthorized users to change the plugin's settings, potentially leading to improper user registration controls.