CVE-2022-4266: Speakdigital Bulk Delete Users By Email

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete non admin users by knowing their email via a CSRF attack

Affected products

• Speakdigital Bulk Delete Users By Email: up to and including 1.2

Published 2022-12-26. Last modified 2026-06-17.