WordPress Userpro Plugin Authentication Bypass (CVE-2017-16562)

An authentication bypass vulnerability exists in WordPress Userpro Plugin. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system...

Immunity Canvas: WPUSERPRO_RCE

Name| wpuserprorce ---|--- CVE| CVE-2017-16562 Exploit Pack| CANVAS Description| Wordpress Remote Command Execution Through UserPro Plugin login bypass Notes| References: https://www.exploit-db.com/exploits/43117/ Repeatability: Infinite VENDOR: UserPro Plugin CVE Url:...

CVE-2017-16562

The UserPro plugin for WordPress (versions prior to 4.9.17.1 ) is vulnerable to a remote authentication bypass . When a site uses the default "admin" username, a remote unauthenticated attacker can obtain administrative access by appending ?up_auto_log=true to the QUERY_STRING of the default URI....