Lucene search

WordfenceCVE-2021-4343

HistoryJun 07, 2023 - 2:15 a.m.

CVE-2021-4343

2023-06-0702:15:13

CWE-862

Wordfence

web.nvd.nist.gov

cve-2021-4343

wordpress

unauthenticated account creation

vulnerability

ajax action function

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

60.1%

JSON

The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is due to the stm_listing_register AJAX action function being accessible and taking roles unprotected. This makes it possible for unauthenticated attackers to create accounts, even those with administrator privileges.

Affected configurations

Nvd

Vulners

Node

stylemixthemesulistingRange≤1.6.6wordpress

VendorProductVersionCPE
stylemixthemesulisting*cpe:2.3:a:stylemixthemes:ulisting:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
stylemixthemes	ulisting	*	cpe:2.3:a:stylemixthemes:ulisting::::::wordpress::*

CNA Affected

[
  {
    "vendor": "stylemix",
    "product": "Directory Listings WordPress plugin – uListing",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "1.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/1c6bf45b-b02d-43bb-b682-7f1ae994e1d3?source=cve

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

60.1%

JSON

Related for CVE-2021-4343