IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.8Yüksek

CVE-2024-8246Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation

themekraft Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC); themekraft post_form_registratio… Yayım: (2 yıl önce)

Açıklama

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to set the default role on registration forms. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with a custom role that allows them to register as administrators.

Zayıflık türü (CWE): CWE-269

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
themekraft post_form_registration_form_profile_form_for_user_profiles_and_content_forms ≤ 2.8.11
themekraft Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) ≤ 2.8.11

Kaynaklar ve yamalar

Aynı üründe son açıklar — WordPress plugins & themes

5.3Orta
CVE-2026-119171

Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 - 1.7.3 - Unauthenticated Paid Option Surcharge Bypass via Add-to-Cart Choice Field

Advanced Product Fields (Product Addons) for WooCommerce

The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthent…