Lucene search
PRIOn knowledge basePRION:CVE-2021-24649HistoryNov 21, 2022 - 11:15 a.m.
Design/Logic Flaw
2022-11-2111:15:00
PRIOn knowledge base
www.prio-n.com
4
wp user frontend
wordpress plugin
urhidden" parameter
registration form
encryption
auth_key
auth_salt
account role
admin account
security flaw
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin
| CPE | Name | Operator | Version |
|---|---|---|---|
| wp_user_frontend | lt | 3.5.29 |
Related
cve
cve
CVE-2021-24649
2022-11-21 11:15:12
wpvulndb
wpvulndb
WP User Frontend < 3.5.29 - Obscure Registration as Admin
2022-10-31 00:00:00
nvd
nvd
CVE-2021-24649
2022-11-21 11:15:12
patchstack
patchstack
wpexploit
wpexploit
WP User Frontend < 3.5.29 - Obscure Registration as Admin
2022-10-31 00:00:00
cvelist
cvelist
CVE-2021-24649 WP User Frontend < 3.5.29 - Obscure Registration as Admin
2022-11-21 00:00:00
cnvd
cnvd
WordPress WP User Frontend authorization issue vulnerability
2022-11-23 00:00:00