CVE-2023-2446
UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account.
El complemento UserPro para WordPress es vulnerable a la divulgación de información confidencial a través del código corto 'userpro' en versiones hasta la 5.1.1 incluida. Esto se debe a una restricción insuficiente de los metavalores sensibles del usuario que se pueden invocar a través de ese código abreviado. Esto hace posible que atacantes autenticados, con permisos de nivel de suscriptor y superiores, recuperen metadatos de usuario sensibles que pueden usarse para obtener acceso a una cuenta de usuario con altos privilegios.
WordPress UserPro plugin versions 5.1.1 and below suffer from an insecure password reset mechanism, information disclosure, and authentication bypass vulnerabilities. Versions 5.1.4 and below suffer from privilege escalation and shortcode execution vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-05-01 CVE Reserved
- 2023-11-21 CVE Published
- 2024-08-02 CVE Updated
- 2024-10-22 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (3)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Userproplugin Search vendor "Userproplugin" | Userpro Search vendor "Userproplugin" for product "Userpro" | < 5.1.2 Search vendor "Userproplugin" for product "Userpro" and version " < 5.1.2" | wordpress |
Affected
|