PT-2021-16164 · WordPress · The Registration Forms – User Profile

Ayecode Ltd + 1 · Published 2021-11-08 · Updated 2021-11-10 · CVE-2021-24647

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin versions prior to 3.1.7.6

Description The issue is related to a flaw in the social login implementation, allowing an unauthenticated attacker to login as any user on the site by only knowing their user id or username.

Recommendations For versions prior to 3.1.7.6, update to version 3.1.7.6 or later to resolve the issue. As a temporary workaround, consider restricting access to social login features until the update is applied. Avoid using the username or user id parameters in sensitive operations until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-24647

Affected Products

The Registration Forms – User Profile

References · 3

• 🔥 https://wpscan.com/vulnerability/40d347b1-b86e-477d-b4c6-da105935ce37 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24647 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24647 · Security Note