CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file.
Explanation of Vulnerability in Simple Terms
The User Registration & Membership plugin for WordPress fails to properly check permissions before allowing certain actions. An attacker without authentication can modify data or disrupt site functionality. This affects all versions up to 3.1.5. Site administrators should update immediately to a version newer than 3.1.5.
What an attacker can do
Modify site data or disrupt functionality without logging in.
Potential impact on your site
Unauthorized users can alter membership data, user profiles, or registration settings on your site.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
