CVE-2021-34621

🗓️ 07 Jul 2021 12:21:16Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 121 Views🌐 WEB

Vulnerability in user registration component of ProfilePress WP plugin

Reporter	Title	Published	Views	Family All 24
0day.today	WordPress ProfilePress 3.1.3 Plugin - Privilege Escalation (Unauthenticated) Exploit	31 Aug 202100:00	–	zdt
GithubExploit	Script-for-profile-press-exploit-in-wordpress	29 Apr 202610:38	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Properfraction Profilepress	9 Aug 202311:41	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Properfraction Profilepress	12 Aug 202321:51	–	githubexploit
Circl	CVE-2021-34621	5 Jul 202112:18	–	circl
CNNVD	WordPress 访问控制错误漏洞	7 Jul 202100:00	–	cnnvd
CNVD	WordPress ProfilePress plugin trust management issue vulnerability	9 Jul 202100:00	–	cnvd
Check Point Advisories	WordPress ProfilePress Plugin Privilege Escalation (CVE-2021-34621)	29 Sep 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-34621 ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation	7 Jul 202112:21	–	cvelist
Exploit DB	WordPress Plugin ProfilePress 3.1.3 - Privilege Escalation (Unauthenticated)	31 Aug 202100:00	–	exploitdb

NVD

Vulners

Vulnrichment

Node

properfraction profilepressRange3.0.0–3.1.3wordpress

[
  {
    "product": "ProfilePress",
    "vendor": "ProfilePress",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0 - 3.1.3"
      }
    ]
  }
]

Source	Link
wordfence	www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin/
packetstormsecurity	www.packetstormsecurity.com/files/163973/WordPress-ProfilePress-3.1.3-Privilege-Escalation.html

Parameter	Position	Path	Description	CWE
reg_username	request body	wp-admin/admin-ajax.php	Unauthenticated privilege escalation via manipulation of user meta (wp_capabilities) during registration to create an administrator account.	CWE-269, CWE-306
reg_email	request body	wp-admin/admin-ajax.php	Unauthenticated privilege escalation via manipulation of user meta (wp_capabilities) during registration to create an administrator account.	CWE-269, CWE-306
reg_password	request body	wp-admin/admin-ajax.php	Unauthenticated privilege escalation via manipulation of user meta (wp_capabilities) during registration to create an administrator account.	CWE-269, CWE-306
reg_password_present	request body	wp-admin/admin-ajax.php	Unauthenticated privilege escalation via manipulation of user meta (wp_capabilities) during registration to create an administrator account.	CWE-269, CWE-306
wp_capabilities[administrator]	request body	wp-admin/admin-ajax.php	Unauthenticated privilege escalation via manipulation of user meta (wp_capabilities) during registration to create an administrator account.	CWE-269, CWE-306
reg_first_name	request body	wp-admin/admin-ajax.php	Unauthenticated privilege escalation via manipulation of user meta (wp_capabilities) during registration to create an administrator account.	CWE-269, CWE-306
reg_last_name	request body	wp-admin/admin-ajax.php	Unauthenticated privilege escalation via manipulation of user meta (wp_capabilities) during registration to create an administrator account.	CWE-269, CWE-306
action	request body	wp-admin/admin-ajax.php	Unauthenticated privilege escalation via manipulation of user meta (wp_capabilities) during registration to create an administrator account.	CWE-269, CWE-306
melange_id	request body	wp-admin/admin-ajax.php	Unauthenticated privilege escalation via manipulation of user meta (wp_capabilities) during registration to create an administrator account.	CWE-269, CWE-306

21 Nov 2024 06:10Current

9.3High risk

Vulners AI Score9.3

CVSS 27.5

CVSS 3.19.8

EPSS0.93479

SSVC