The MemberPress plugin for WordPress versions up to and including 1.14.1 contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw arises from a bypassable nonce verification in the save_profile_fields() function, where an isset() check allows attackers to omit the nonce parameter and bypass security. Exploitation can enable unauthenticated attackers to change authenticated users' email addresses via forged requests, potentially leading to account takeover through password reset mechanisms.