CVE-2022-4024 Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User Deletion

2022-12-1913:41:40

WPScan

www.cve.org

cve-2022-4024

pie register

unauthenticated

user deletion

wordpress

csrf

authorization

arbitrary users

init action

attackers

posts

0.001 Low

EPSS

Percentile

47.6%

JSON

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Registration Forms",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "3.8.1.3"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe

0.001 Low

EPSS

Percentile

47.6%

JSON

Related for CVELIST:CVE-2022-4024