PT-2023-19534 · WordPress+1 · Userpro

István Márton · Published 2023-11-22 · Updated 2025-10-31 · CVE-2023-2437

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UserPro plugin for WordPress versions through 5.1.1

Description The UserPro plugin for WordPress through version 5.1.1 has a flaw that allows bypassing authentication through the userpro fbconnect API endpoint. This bypass is achieved via the userpro fbconnect AJAX action.

Recommendations Update the UserPro plugin to a version later than 5.1.1.

Exploit

Fix

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

Related Identifiers

CVE-2023-2437

Affected Products

Userpro

References · 9

• 🔥 http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html · Exploit
• https://osv.dev/vulnerability/CVE-2023-2437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2437 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b3cf9f38-c20e-40dc-a7a1-65b0c6ba7925?source=cve · Note
• https://t.me/cybersecuritytechnologies/9447 · Telegram Post
• https://twitter.com/intel_ears/status/1984190246876303616 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1984153396115623941 · Twitter Post
• https://twitter.com/cipher_lnmiit/status/1984342077732421786 · Twitter Post
• https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681 · Note