CVE Vulnerabilities

CVE-2024-0701

Published: Feb 05, 2024 | Modified: Feb 13, 2024
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the Disabled registration Membership feature within the plugins General settings. This makes it possible for unauthenticated attackers to register an account even when account registration has been disabled by an administrator.

Affected Software

Name Vendor Start Version End Version
Userpro Userproplugin * 5.1.6

References