The user-access-manager plugin prior to 1.2 for WordPress has CSRF.
user access manager project user access manager