Vulnerability Description
The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the plugin's General settings. This makes it possible for unauthenticated attackers to register an account even when account registration has been disabled by an administrator.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Userproplugin | Userpro | <= 5.1.6 |
Related Weaknesses (CWE)
References
- https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ea070d9c-c04c-432f-a11Third Party Advisory
- https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ea070d9c-c04c-432f-a11Third Party Advisory
FAQ
What is CVE-2024-0701?
CVE-2024-0701 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled regis...
How severe is CVE-2024-0701?
CVE-2024-0701 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-0701?
Check the references section above for vendor advisories and patch information. Affected products include: Userproplugin Userpro.