CVE-2022-4024 - Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User Deletion

Back Back to CVE browser

MEDIUM

Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User Deletion

Published Dec 19, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)

Affected products

Vendor n/a Product Registration Forms Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.8.1.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Registration Forms

unaffected

Version	Status	Constraints
0	affected	<3.8.1.3

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51403
Advisory
https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51403		Advisory
https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe		exploitvdb-entrytechnical-descriptionThird Party Advisory