Murad Akhmedov

**Name of the Vulnerable Software and Affected Versions** User Frontend WordPress plugin versions prior to 4.3.12 **Description** The plugin fails to prevent tampering with the role assigned via its registration form. This allows unauthenticated users to register with a higher privileged role, such as Editor. This issue occurs on installations using a PHP build where the sodium extension (a library for modern cryptography) is unavailable and a registration page has been configured. The administrator role cannot be obtained through this method. **Recommendations** Update the User Frontend WordPress plugin to version 4.3.12 or later.

**Name of the Vulnerable Software and Affected Versions** User Frontend WordPress plugin versions prior to 4.3.12 **Description** The plugin fails to verify if user registration is enabled on the site before creating a new account. This allows unauthenticated users to register accounts even when the site settings explicitly disable registration. Any account created through this flaw is assigned the default site role. **Recommendations** Update the User Frontend WordPress plugin to version 4.3.12 or later.

**Name of the Vulnerable Software and Affected Versions** The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 **Description** The plugin fails to verify if the user saving a gallery is the actual owner. This allows any user with the gallery-management capability to overwrite stored settings for any gallery on the site, including the filesystem path and galleries belonging to other users. **Recommendations** Update the plugin to version 4.5.0 or later.