CVE-2026-1644 is a CSRF vulnerability in the WP Frontend Profile plugin for WordPress caused by missing nonce validation on the 'update_action' function. This flaw enables attackers to perform unauthorized actions such as approving or rejecting user registrations by convincing an administrator to execute a crafted request. The vulnerability affects all versions up to 1.3.8. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. No patch or remediation details are currently available from the vendor.

An attacker can exploit this vulnerability to manipulate user account registration approvals or rejections without authentication, relying on social engineering to induce an administrator to perform the action. This could lead to unauthorized account management changes but does not directly impact confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links and consider implementing additional protections such as web application firewalls or manual verification of user registrations.