IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.8Hoch

CVE-2024-6069Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

genetechproducts Pie Register – User Registration, Profiles & Content Restriction; genetech_products registration_forms; genetech_products user_registration_fo… Veröffentlicht: (vor 2 Jahren)

Beschreibung

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins. As a result attackers might achieve code execution on the targeted server

Schwachstellentyp (CWE): CWE-862

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
genetech_products content_registration ≤ 3.8.3.4
genetech_products front_end_user_profile_login_form ≤ 3.8.3.4
genetech_products invitation_based_registrations ≤ 3.8.3.4
genetech_products registration_forms ≤ 3.8.3.4
genetech_products user_registration_forms ≤ 3.8.3.4
genetechproducts Pie Register – User Registration, Profiles & Content Restriction ≤ 3.8.3.4

Referenzen und Patches

Neue CVEs im selben Produkt — WordPress plugins & themes

7.2Hoch
CVE-2026-120687

Lightbox & Modal Popup WordPress Plugin <= 2.8.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers

fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient…

9.8Kritisch
CVE-2026-19907

Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator

shipo Shipo

The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's c…