WP User Frontend Plugin up to 3.5.28 on WordPress improper authentication

Summaryinfo

A vulnerability classified as critical was found in WP User Frontend Plugin up to 3.5.28 on WordPress. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to improper authentication. This vulnerability is registered as CVE-2021-24649. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in WP User Frontend Plugin up to 3.5.28 on WordPress (WordPress Plugin) and classified as critical. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin

The weakness was published 11/21/2022. The advisory is shared for download at wpscan.com. This vulnerability was named CVE-2021-24649 since 01/14/2021. There are neither technical details nor an exploit publicly available.

Upgrading to version 3.5.29 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• WP User Frontend Plugin

Version

• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.5.6
• 3.5.7
• 3.5.8
• 3.5.9
• 3.5.10
• 3.5.11
• 3.5.12
• 3.5.13
• 3.5.14
• 3.5.15
• 3.5.16
• 3.5.17
• 3.5.18
• 3.5.19
• 3.5.20
• 3.5.21
• 3.5.22
• 3.5.23
• 3.5.24
• 3.5.25
• 3.5.26
• 3.5.27
• 3.5.28

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion