CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-38693 – WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-38693
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7. The WP User Frontend plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in versions up to, and including, 4.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://patchstack.com/database/vulnerability/wp-user-frontend/wordpress-wp-user-frontend-plugin-4-0-7-sql-injection-vulnerability?_s_id=cve • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47682 – WordPress WP User Frontend plugin <= 3.6.5 - Authenticated Privilege Escalation vulnerability
https://notcve.org/view.php?id=CVE-2023-47682
Improper Privilege Management vulnerability in weDevs WP User Frontend allows Privilege Escalation.This issue affects WP User Frontend: from n/a through 3.6.5. Una vulnerabilidad de gestión de privilegios incorrecta en la interfaz de usuario de WP de weDevs permite la escalada de privilegios. Este problema afecta la interfaz de usuario de WP: desde n/a hasta 3.6.5. The WP User Frontend – Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission Plugin plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.5. This is due to the plugin not providing sufficient controls on the ability to supply a role on the registration form shortcode rendered via the registration_form function. • https://patchstack.com/database/vulnerability/wp-user-frontend/wordpress-wp-user-frontend-plugin-3-6-5-authenticated-privilege-escalation-vulnerability?_s_id=cve • CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45002 – WP User Frontend <= 3.6.8 - Missing Authorization via AJAX actions
https://notcve.org/view.php?id=CVE-2023-45002
The WP User Frontend plugin for WordPress is vulnerable to unauthorized functionality use due to a missing capability check on several functions corresponding to AJAX actions in versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to install some plugins, delete user packages, list taxonomies, dismiss promotional offers, and review notices, and preview forms. • CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24649 – WP User Frontend < 3.5.29 - Obscure Registration as Admin
https://notcve.org/view.php?id=CVE-2021-24649
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin El complemento de WordPress WP User Frontend anterior a 3.5.29 utiliza un argumento proporcionado por el usuario llamado urhidden en su formulario de registro, que contiene la función para la cuenta que se creará, cifrada mediante wpuf_encryption(). Esto podría permitir que un atacante que tenga acceso a las constantes AUTH_KEY y AUTH_SALT (a través de un problema de acceso a archivos arbitrarios, por ejemplo, o si el blog usa las claves predeterminadas) cree una cuenta con cualquier rol que desee, como administrador. The WP User Frontend plugin for WordPress is vulnerable to privilege escalation due to the default user role checking on the process_registration function in versions up to, and including, 3.5.28 which accepts user supplied input via the urhidden value. This makes it possible for attackers, under certain circumstances, to register as administrators. • https://wpscan.com/vulnerability/9486744e-ab24-44e4-b06e-9e0b4be132e2 • CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 4CVE-2021-25076 – WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-25076
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting El plugin WP User Frontend de WordPress versiones anteriores a 3.5.26, no comprueba ni escapa del parámetro status antes de usarlo en una sentencia SQL en el panel de control de los suscriptores, conllevando a una inyección SQL. Debido a una falta de saneo y escape, esto también podría conllevar a un problema de tipo Cross-Site Scripting Reflejado WordPress WP User Frontend plugin version 3.5.25 suffers from an authenticated remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/50772 https://github.com/0xAbbarhSF/CVE-2021-25076 http://packetstormsecurity.com/files/166071/WordPress-WP-User-Frontend-3.5.25-SQL-Injection.html https://plugins.trac.wordpress.org/changeset/2648715 https://wpscan.com/vulnerability/6d3eeba6-5560-4380-a6e9-f008a9112ac6 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •