PT-2023-12447 · WordPress · Unauthenticated Account Creation
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Unauthenticated Account Creation plugin for WordPress versions up to, and including, 1.6.6
Description
The issue allows unauthenticated attackers to create accounts, including those with administrator privileges, due to the
stm listing register AJAX action function being accessible and taking roles unprotected.Recommendations
For Unauthenticated Account Creation plugin for WordPress versions up to, and including, 1.6.6, consider disabling the
stm listing register AJAX action function until a patch is available to prevent unauthenticated account creation.Exploit
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Unauthenticated Account Creation