CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24649 – WP User Frontend < 3.5.29 - Obscure Registration as Admin
https://notcve.org/view.php?id=CVE-2021-24649
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin El complemento de WordPress WP User Frontend anterior a 3.5.29 utiliza un argumento proporcionado por el usuario llamado urhidden en su formulario de registro, que contiene la función para la cuenta que se creará, cifrada mediante wpuf_encryption(). Esto podría permitir que un atacante que tenga acceso a las constantes AUTH_KEY y AUTH_SALT (a través de un problema de acceso a archivos arbitrarios, por ejemplo, o si el blog usa las claves predeterminadas) cree una cuenta con cualquier rol que desee, como administrador. The WP User Frontend plugin for WordPress is vulnerable to privilege escalation due to the default user role checking on the process_registration function in versions up to, and including, 3.5.28 which accepts user supplied input via the urhidden value. This makes it possible for attackers, under certain circumstances, to register as administrators. • https://wpscan.com/vulnerability/9486744e-ab24-44e4-b06e-9e0b4be132e2 • CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 4CVE-2021-25076 – WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-25076
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting El plugin WP User Frontend de WordPress versiones anteriores a 3.5.26, no comprueba ni escapa del parámetro status antes de usarlo en una sentencia SQL en el panel de control de los suscriptores, conllevando a una inyección SQL. Debido a una falta de saneo y escape, esto también podría conllevar a un problema de tipo Cross-Site Scripting Reflejado WordPress WP User Frontend plugin version 3.5.25 suffers from an authenticated remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/50772 https://github.com/0xAbbarhSF/CVE-2021-25076 http://packetstormsecurity.com/files/166071/WordPress-WP-User-Frontend-3.5.25-SQL-Injection.html https://plugins.trac.wordpress.org/changeset/2648715 https://wpscan.com/vulnerability/6d3eeba6-5560-4380-a6e9-f008a9112ac6 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •