User Registration < 2.3.3 - Subscriber+ PHP Object Injection

2023-03-2100:00:00

wpscan.com

plugin

unserialization

user input

gadget

authentication

0.0004 Low

EPSS

Percentile

9.1%

JSON

The plugin unserializes user input via the ur_get_user_extra_fields and user_registration_form_field function, which could allow any authenticated users, such as subscriber to perform PHP Object Injection when a suitable gadget is present on the blog

CPENameOperatorVersion
user-registrationlt2.3.3

CPE	Name	Operator	Version
	user-registration	lt	2.3.3

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for WPVDB-ID:74957215-ABA8-4D3A-9418-00BB2C65632F