CVE-2025-4334

CVE-2025-4334 - Simple User Registration --form 인수: -u / --url → 기본 WordPress URL 예: https://target.com/wordpress/ --form → 등록 양식의 전체 URL 예: https://target.com/wpr/default-registration/ 예시: python3 CVE-2025-4334.py -u https://example.com/wordpress --form...

Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators. id: CVE-2025-4334 info: name: Simple User Registration = 6.3 -...

CVE-2025-4334

🔓 Simple User Registration = 6.3 - 인증되지 않은 권한 상승 📄 설명 WordPress용 Simple User Registration 플러그인은 6.3 을 포함한 모든 버전에서 권한 상승 취약점에 노출되어 있습니다. 이는 등록 중에 제공될 수 있는 사용자 메타 값에 대한 제한이 충분하지 않기 때문입니다. 이로 인해 인증되지 않은 공격자 가 관리자 로 등록할 수 있습니다. 🛡️ 취약점 세부 정보 속성| 값 ---|--- 유형| 부적절한 권한 관리 CVE| CVE-2025-4334 CVSS 점수| 9.8...

CVE-2026-10522 Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...

CVE-2026-10522

The MemberHero WordPress plugin (versions through 6.9 ) contains a vulnerability where it fails to restrict account fields during the frontend registration process. This flaw allows unauthenticated attackers to register new users with arbitrary roles , such as Administrator , potentially leading ...

📄 WordPress Simple User Capabilities 1.0 Unauthenticated Privilege Escalation

WordPress Simple User Capabilities plugin version 1.0 contains an unauthenticated privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrates the vulnerabl...

CVE-2026-57676

Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9...

CVE-2026-57676

Summary: CVE-2026-57676 affects the WordPress plugin “Simple User Avatar” (versions up to and including 4.9). The issue is an Insecure Direct Object References (IDOR) /authorization bypass caused by an authorization check vulnerability tied to a user-controlled key, leading to insecure access due...

CVE-2026-57676

Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9...

CVE-2026-57676 WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9...

CVE-2026-57676 WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9...

EUVD-2026-40056

Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9...

CVE-2026-57676: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9...

PT-2026-53236

Name of the Vulnerable Software and Affected Versions Simple User Avatar versions prior to 5.0 Description An authorization bypass exists due to a user-controlled key, which allows the exploitation of incorrectly configured access control security levels. This issue is characterized as an Insecur...

WordPress Plugin Simple User Registration Access Control Error Vulnerability

WordPress is a set of blogging platform developed using the PHP language, the platform has the ability to set up a personal blog site on a server based on PHP and MySQL, WordPress plugin is an application plugin. An access control error vulnerability exists in the WordPress plugin Simple User...

CVE-2026-0844

The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profilesavefield' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to...

CVE-2026-0844

The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profilesavefield' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to...

CVE-2026-0844

The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profilesavefield' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to...

PT-2026-5092

The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile save field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to...

CVE-2026-0844: Improper Access Control

The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profilesavefield' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to...