PT-2015-4082 · WordPress · Pie Register

Published 2015-01-23 · Updated 2015-01-26 · CVE-2014-8802

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pie Register plugin versions prior to 2.0.14

Description The issue allows remote attackers to add a user by uploading a crafted CSV file or activate a user account via a verifyit action due to improper access restriction to certain functions in pie-register.php.

Recommendations For versions prior to 2.0.14, update to version 2.0.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the pie-register.php file until a patch is available. Avoid using the verifyit action in the affected plugin until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-8802

Affected Products

Pie Register

References · 6

• 🔥 https://exploit-db.com/exploits/35823 · Exploit
• 🔥 http://security.szurek.pl/pie-register-2013-privilege-escalation.html · Exploit
• https://wordpress.org/plugins/pie-register/changelog · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8802 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8802 · Note
• http://secunia.com/advisories/62351 · Note