PT-2023-31786 · WordPress · Easy Registration Forms

István Márton + 1 · Published 2023-09-23 · Updated 2023-10-07 · CVE-2023-5134

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Easy Registration Forms for WordPress versions up to, and including, 2.1.1

Description The issue allows authenticated attackers with subscriber-level capabilities or above to retrieve arbitrary sensitive user meta via the erforms user meta shortcode due to insufficient controls on the information retrievable. This enables the disclosure of sensitive information.

Recommendations For versions up to, and including, 2.1.1, consider disabling the erforms user meta shortcode until a patch is available to prevent information disclosure. Restrict access to sensitive user meta to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-5134

Affected Products

Easy Registration Forms

References · 7

• https://osv.dev/vulnerability/CVE-2023-5134 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5134 · Security Note
• https://plugins.trac.wordpress.org/browser/easy-registration-forms/tags/2.1.1/includes/class-user.php#L835 · Patch
• https://t.me/cvenotify/58513 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/562fe11f-36a0-4f23-9eed-50ada7ab2961?source=cve · Note
• https://twitter.com/afaghhosting/status/1710612675636425159 · Twitter Post
• https://t.me/cibsecurity/70962 · Telegram Post