Описание
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
Ссылки
- Issue Tracking
- Issue TrackingThird Party Advisory
- ExploitIssue TrackingThird Party AdvisoryVDB Entry
- Issue Tracking
- Issue TrackingThird Party Advisory
- ExploitIssue TrackingThird Party AdvisoryVDB Entry
Уязвимые конфигурации
Конфигурация 1Версия до 4.9.17.1 (исключая)
cpe:2.3:a:userproplugin:userpro:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 98%
0.48165
Средний
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-287
Связанные уязвимости
CVSS3: 9.8
github
больше 3 лет назад
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
EPSS
Процентиль: 98%
0.48165
Средний
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-287