Force First and Last Name as Display Name

Force First and Last Name as Display Name has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 5.4 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Force First and Last Name as Display Name has a vendor fix available, so running the current release closes it.

All of these findings were reported by Kévin Mosbahi (Mika). Force First and Last Name as Display Name is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

5.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Force First and Last Name as Display Name vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.4CVE-2023-28419

Force First and Last Name as Display Name <= 1.2 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records


2023-03-16 00:00	Force First and Last Name as Display Name <= 1.2 - Cross-Site Request Forgery Force First and Last Name as Display… <= 1.2	`CVE-2023-28419`	5.4 Medium	Kévin Mosbahi (Mika)	Yes

Showing 1–1 of 1 reports

Latestv1.2.2

Force First and Last Name as Display Name

Author

Andrew Lima

4.3(18)

86/100

Last Updated

2026-07-21 (2mo ago)

Active Installs

2,000+

Downloads

33,712

Requires WP

5.2+

Requires PHP

Tested up to

WP 7.0.4

Created

2013-09-06 (13y ago)

This plugin hides the “Display Name” field on the Edit Profile screen for all users. Instead of allowing users to set this field, the plugin will always set the User field display_name to their first and last name. If these field are empty, display_name will be set to their username. Display names are set when the user registers as well as when a user’s profile is updated via the WordPress admin. The plugin includes a batch process to update the display name for existing users. Navigate to Settings > Force First Last in the WordPress admin to run the update.

View on WordPress.org