Design/Logic Flaw

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...

CVE-2021-24649: Undefined Security Weakness

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...

PT-2022-9443

Name of the Vulnerable Software and Affected Versions WP User Frontend WordPress plugin versions prior to 3.5.29 Description The issue allows an attacker to create an account with any role they want, such as admin, by exploiting a user-supplied argument called urhidden in the registration form...