Products
Registration Forms Plugin for WordPress
- up to 3.8.3.4
Source
security@wordfence.com
Tags
CVE-2024-6069 details
Last Modified : July 9, 2024, 6:19 p.m.
Description
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation/deactivation due to missing capability checks on the pieregister_install_addon, pieregister_activate_addon and pieregister_deactivate_addon functions in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install, activate and deactivate arbitrary plugins. As a result attackers might achieve code execution on the targeted server
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8.8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
8.8
Exploitability Score
2.8
Impact Score
5.9
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L727 | security@wordfence.com |
| https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L761 | security@wordfence.com |
| https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L794 | security@wordfence.com |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/b946ee73-4cf9-48c8-b456-285b118c6b05?source=cve | security@wordfence.com |