PT-2022-9443 · WordPress · Wp User Frontend

Ayecode Ltd + 1 · Published 2022-11-21 · Updated 2022-11-23 · CVE-2021-24649

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP User Frontend WordPress plugin versions prior to 3.5.29

Description The issue allows an attacker to create an account with any role they want, such as admin, by exploiting a user-supplied argument called urhidden in the registration form. This argument contains the role for the account to be created with, encrypted via wpuf encryption(). An attacker having access to the AUTH KEY and AUTH SALT constant, either via an arbitrary file access issue or if the blog is using the default keys, can exploit this.

Recommendations For WP User Frontend WordPress plugin versions prior to 3.5.29, update to version 3.5.29 or later to resolve the issue. As a temporary workaround, consider restricting access to the registration form or monitoring account creations closely to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2021-24649

Affected Products

Wp User Frontend

References · 4

• 🔥 https://wpscan.com/vulnerability/9486744e-ab24-44e4-b06e-9e0b4be132e2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24649 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24649 · Vendor Advisory
• https://t.me/cvenotify/38152 · Telegram Post