CVE-2025-13493 affects the Latest Registered Users plugin for WordPress by webrndexperts. The vulnerability arises from missing authorization and nonce validation in the rnd_handle_form_submit function, which is hooked to admin_post_my_simple_form and admin_post_nopriv_my_simple_form actions. This allows unauthenticated attackers to export complete user details (excluding passwords and sensitive tokens) in CSV format via the 'action' parameter. The issue impacts all versions up to and including 1.4. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact.

An unauthenticated attacker can export complete user details in CSV format, potentially exposing sensitive user information except passwords and sensitive tokens. This compromises user privacy and confidentiality but does not affect system integrity or availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's functionality and monitor for unusual requests targeting the 'action' parameter. Consider disabling or removing the plugin if user data exposure risk is unacceptable.