by Kastro
Paper/Archive/CVE-2024-9518

CVE-2024-9518

userplus User registration & user profile – UserPlus — UserPlus <= 2.0 - Unauthenticated Privilege Escalation

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.3.443 × 208.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to insufficient restriction on the 'form_actions' and 'userplus_update_user_profile' functions. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.

Affected

ProductAffectedFixed inSource
User registration & user profile – UserPlus≤ 2.0–CNA
user_registration_and_user_profile≤ 2.0–CISA-ADP

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/2489e649-27f7-4ca0-8655-0957016fa89a?source=cverefplugins.trac.wordpress.org/browser/userplus/trunk/functions/user-functions.php?rev=1604604#L47