PT-2022-24743 · WordPress · User Registration

Cydave · Published 2022-12-12 · Updated 2022-12-14 · CVE-2022-3912

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions User Registration WordPress plugin versions prior to 2.2.4.1

Description The issue concerns the improper restriction of file uploads via an AJAX action, which is accessible to both unauthenticated and authenticated users. This could allow unauthenticated users to upload PHP files, for example.

Recommendations For versions prior to 2.2.4.1, update to version 2.2.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX action used for file uploads to prevent unauthenticated users from uploading malicious files.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-3912

Affected Products

User Registration

References · 4

• 🔥 https://wpscan.com/vulnerability/968c677c-1beb-459b-8fd1-7f70bcaa4f74 · Exploit
• https://osv.dev/vulnerability/CVE-2022-3912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3912 · Security Note
• https://t.me/cvenotify/39661 · Telegram Post