The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
Published July 28, 2019.
Simple-membership-plugin Simple Membership