Lucene search

WordfenceCVE-2024-6069

HistoryJul 09, 2024 - 9:15 a.m.

CVE-2024-6069

2024-07-0909:15:09

Wordfence

web.nvd.nist.gov

wordpress

vulnerability

arbitrary

installation

activation

deactivation

plugin

code execution

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

29.3%

JSON

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation/deactivation due to missing capability checks on the pieregister_install_addon, pieregister_activate_addon and pieregister_deactivate_addon functions in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install, activate and deactivate arbitrary plugins. As a result attackers might achieve code execution on the targeted server

Affected configurations

Vulners

Vulnrichment

Node

genetechproductsregistration_forms_–_user_registration_forms\,_invitation-based_registrations\,_front-end_user_profile\,_login_form_\&_content_restrictionRange≤3.8.3.4wordpress

VendorProductVersionCPE
genetechproductsregistration_forms_–_user_registration_forms\,_invitation-based_registrations\,_front-end_user_profile\,_login_form_\&_content_restriction*cpe:2.3:a:genetechproducts:registration_forms_–_user_registration_forms\,_invitation-based_registrations\,_front-end_user_profile\,_login_form_\&_content_restriction:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
genetechproducts	registration_forms_–_user_registration_forms\,_invitation-based_registrations\,_front-end_user_profile\,_login_form_\&_content_restriction	*	cpe:2.3:a:genetechproducts:registration_forms_–_user_registration_forms\,_invitation-based_registrations\,_front-end_user_profile\,_login_form_\&_content_restriction::::::wordpress::*

CNA Affected

[
  {
    "vendor": "genetechproducts",
    "product": "Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.8.3.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L727

plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L761

plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L794

www.wordfence.com/threat-intel/vulnerabilities/id/b946ee73-4cf9-48c8-b456-285b118c6b05?source=cve

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

29.3%

JSON

Related for CVE-2024-6069