Lucene search

WordfenceCVELIST:CVE-2024-6069

HistoryJul 09, 2024 - 8:33 a.m.

CVE-2024-6069 Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation/Deactivation

2024-07-0908:33:11

Wordfence

www.cve.org

cve-2024-6069

pie register

wordpress

missing authorization

arbitrary plugin installation

code execution

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

29.3%

JSON

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation/deactivation due to missing capability checks on the pieregister_install_addon, pieregister_activate_addon and pieregister_deactivate_addon functions in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install, activate and deactivate arbitrary plugins. As a result attackers might achieve code execution on the targeted server

CNA Affected

[
  {
    "vendor": "genetechproducts",
    "product": "Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.8.3.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L727

plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L761

plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L794

www.wordfence.com/threat-intel/vulnerabilities/id/b946ee73-4cf9-48c8-b456-285b118c6b05?source=cve

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

29.3%

JSON

Related for CVELIST:CVE-2024-6069