// For flags

CVE-2024-3295

User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file.

El complemento User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin para WordPress es vulnerable a la pérdida no autorizada de datos debido a una falta de verificación de capacidad en la función perfil_pic_remove en versiones hasta la 3.1.5 incluida. Esto hace posible que atacantes no autenticados eliminen cualquier archivo multimedia.

*Credits: wesley
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-04-04 CVE Reserved
  • 2024-04-15 CVE Published
  • 2024-05-03 EPSS Updated
  • 2024-08-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Wpeverest
Search vendor "Wpeverest"
 User Registration – Custom Registration Form, Login Form, And User Profile WordPress Plugin
Search vendor "Wpeverest" for product "User Registration – Custom Registration Form, Login Form, And User Profile WordPress Plugin"
 <= 3.1.5
Search vendor "Wpeverest" for product "User Registration – Custom Registration Form, Login Form, And User Profile WordPress Plugin" and version " <= 3.1.5"
en
Affected