PT-2024-15762 · WordPress · Userpro

Rob Stevens · Published 2024-02-05 · Updated 2024-02-13 · CVE-2024-0701

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions UserPro plugin for WordPress versions up to, and including, 5.1.6

Description The issue is related to a Security Feature Bypass in the UserPro plugin for WordPress. This bypass occurs due to the plugin's reliance on client-side restrictions to enforce the 'Disabled registration' Membership feature within its General settings. As a result, unauthenticated attackers can register an account even when an administrator has disabled account registration.

Recommendations For versions up to, and including, 5.1.6, update to a version later than 5.1.6 to resolve the issue. As a temporary workaround, consider disabling the 'Disabled registration' Membership feature or restricting access to the registration endpoint until a patch is available.

Fix

Weakness Enumeration

CWE-602

Related Identifiers

CVE-2024-0701

Affected Products

Userpro

References · 6

• https://osv.dev/vulnerability/CVE-2024-0701 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0701 · Security Note
• https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681 · Patch
• https://twitter.com/VulmonFeeds/status/1754656184353624168 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ea070d9c-c04c-432f-a110-47b9eaa67614?source=cve · Note
• https://twitter.com/CVEnew/status/1754620487529849097 · Twitter Post