CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4958 – User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation
https://notcve.org/view.php?id=CVE-2024-4958
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'import_form_action' function in versions up to, and including, 3.2.0.1. This makes it possible for authenticated attackers, with contributor-level permissions and above, to import a registration form with a default user role of administrator. If an administrator approves or publishes a post or page with the shortcode to the imported form, any user can register as an administrator. El complemento User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin para WordPress es vulnerable a modificaciones no autorizadas de datos debido a una falta de verificación de capacidad en la función 'import_form_action' en versiones hasta la 3.2.0.1 incluida. Esto hace posible que atacantes autenticados, con permisos de nivel de colaborador y superiores, importen un formulario de registro con una función de usuario predeterminada de administrador. • https://plugins.trac.wordpress.org/changeset/3095484/user-registration/tags/3.2.1/includes/class-ur-ajax.php https://www.wordfence.com/threat-intel/vulnerabilities/id/710574a8-a6e2-4ee6-9ea7-03a34994fec7?source=cve • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2417 – User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
https://notcve.org/view.php?id=CVE-2024-2417
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the form_save_action() function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the registration form and make the default registration role administrator. This subsequently allows the attacker to register an account as an administrator on the site. El complemento User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin para WordPress es vulnerable a la escalada de privilegios debido a una falta de verificación de capacidad en la función form_save_action() en todas las versiones hasta la 3.1.5 incluida. Esto hace posible que los atacantes autenticados, con acceso de nivel de suscriptor y superior, actualicen el formulario de registro y conviertan el rol de registro predeterminado en administrador. • https://github.com/wpeverest/user-registration/commit/d265273aa4dddb24ade929be78c6bf1766f1cf00 https://plugins.trac.wordpress.org/changeset/3070439/user-registration/trunk/includes/class-ur-ajax.php https://www.wordfence.com/threat-intel/vulnerabilities/id/d03459d8-b1f2-4270-a294-403754db1f2f?source=cve • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3295 – User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion
https://notcve.org/view.php?id=CVE-2024-3295
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file. El complemento User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin para WordPress es vulnerable a la pérdida no autorizada de datos debido a una falta de verificación de capacidad en la función perfil_pic_remove en versiones hasta la 3.1.5 incluida. Esto hace posible que atacantes no autenticados eliminen cualquier archivo multimedia. • https://plugins.trac.wordpress.org/browser/user-registration/tags/3.1.5/includes/class-ur-ajax.php#L1111 https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/class-ur-ajax.php?rev=3070439#L1115 https://plugins.trac.wordpress.org/changeset/3070439 https://www.wordfence.com/threat-intel/vulnerabilities/id/864a3444-0479-4b9f-beca-584a4a9b8682?source=cve • CWE-862: Missing Authorization •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1812 – Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url
https://notcve.org/view.php?id=CVE-2024-1812
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. El complemento Everest Forms para WordPress es vulnerable a Server-Side Request Forgery en todas las versiones hasta la 2.0.7 incluida a través del parámetro 'font_url'. Esto hace posible que atacantes no autenticados realicen solicitudes web a ubicaciones arbitrarias que se originan en la aplicación web y pueden usarse para consultar y modificar información de servicios internos. • https://plugins.trac.wordpress.org/changeset/3049743/everest-forms https://www.wordfence.com/threat-intel/vulnerabilities/id/d4561441-d147-4c02-a837-c1656e17627d?source=cve • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1720 – User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-1720
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution. El complemento User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del parámetro 'Nombre para mostrar' en todas las versiones hasta la 3.1.4 incluida debido a una entrada insuficiente sanitización y escape de producción. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada. • https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/class-ur-shortcodes.php#L288 https://plugins.trac.wordpress.org/changeset/3045419/user-registration/trunk/includes/class-ur-shortcodes.php https://www.wordfence.com/threat-intel/vulnerabilities/id/62b809dc-4089-4822-8aeb-7049fcfe376e?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •