CVE-2023-3342
User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in version 3.0.2 and fully patched in version 3.0.2.1.
El plugin User Registration para WordPress es vulnerable a la carga de archivos arbitrarios debido a una clave de cifrado codificada y a la falta de validación del tipo de archivo en la función "ur_upload_profile_pic" en las versiones hasta la 3.0.2 inclusive. Esto hace posible que atacantes autenticados con capacidades de nivel suscriptor o superior carguen archivos arbitrarios en el servidor del sitio afectado, lo que puede posibilitar la ejecución remota de código. Esto fue parcialmente parcheado en la versión 3.0.2 y completamente parcheado en la versión 3.0.2.1.
The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hard-coded encryption key and missing file type validation on the ur_upload_profile_pic function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in version 3.0.2 and fully patched in version 3.0.2.1.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2023-06-20 CVE Reserved
- 2023-07-04 CVE Published
- 2024-10-16 CVE Updated
- 2024-10-16 First Exploit
- 2024-10-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/173434/WordPress-User-Registration-3.0.2-Arbitrary-File-Upload.html | Third Party Advisory |
|
| https://www.wordfence.com/threat-intel/vulnerabilities/id/a979e885-f7dd-4616-a881-64f3d97c309d?source=cve | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://lana.codes/lanavdb/c0a58dff-7a5b-4cc0-82d6-2255e61d801c | 2024-10-16 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Wpeverest Search vendor "Wpeverest" | User Registration Search vendor "Wpeverest" for product "User Registration" | < 3.0.2.1 Search vendor "Wpeverest" for product "User Registration" and version " < 3.0.2.1" | wordpress |
Affected
| ||||||