Easy Username Updater
Easy Username Updater has one disclosed vulnerability in the WordSec catalog, all reported in 2022; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Easy Username Updater has a vendor fix available, so running the current release closes it.
All of these findings were reported by Raad Haddad. Easy Username Updater is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2022-2355Easy Username Updater <= 1.0.3 - Cross-Site Request Forgery to Username Change
Read the full analysisVulnerability Records
Easy Username Updater
Author
Yogesh Pant
Easy Username updater is a plugin which allows administrators to change usernames on their site. It provide list of users with their email address,username and role. It changes display name as well. This plugin also do following: Search the user by username, email address, or role. Send the updated username to user by email. How to install? Unzip the downloaded ‘username-updater.zip’ file Upload the ‘username-updater’ folder to ‘/wp-content/plugins’ directory of your WordPress installation Activate the plugin via the WordPress Plugins page A new submenu will automatically create on users menu
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C