Description

WordPress Plugin UserPro-Community and User Profile is prone to multiple vulnerabilities, including security bypass and privilege escalation vulnerabilities. An attacker may leverage these issues to perform otherwise restricted actions and subsequently perform arbitrary shortcode execution, or to bypass the expected capabilities check and perform otherwise restricted actions. WordPress Plugin UserPro-Community and User Profile version 5.1.4 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 5.1.5 or latest

References

https://www.wordfence.com/blog/2023/11/several-critical-vulnerabilities-including-privilege-escalation-authentication-bypass-and-more-patched-in-userpro-wordpress-plugin/

https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681#item-description__updates

Related Vulnerabilities

WordPress Plugin Newsletter-Send awesome emails from WordPress Multiple Vulnerabilities (6.8.1)

WordPress Plugin WP e-Commerce-Store Toolkit Privilege Escalation (2.0)

e107 Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2010-5084)

Oracle HTTP Server Improper Certificate Validation Vulnerability (CVE-2020-26184)

WordPress Plugin Visual Form Builder Multiple Vulnerabilities (2.8.2)

Severity

High

Classification

CVE-2023-2448 CVE-2023-6009 CWE-269 CWE-862 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update