Unauthenticated Account Creation Vulnerability in Unauthenticated Account Creation Plugin for WordPress
CVE-2021-4343

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Directory Listings WordPress Plugin – Ulisting
Vendor
CVE Published:
7 June 2023

Summary

The Unauthenticated Account Creation Plugin for WordPress allows unauthorized users to create accounts, including those with administrator privileges. This vulnerability arises from the exposed stm_listing_register AJAX action, which does not properly restrict role assignment. Attackers can exploit this flaw to gain unjustified access, leading to potential account hijacking and unauthorized actions within the WordPress environment.

Affected Version(s)

Directory Listings WordPress plugin – uListing * < 1.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://blog.nintechnet.com/wordpress-ulisting-plugin-fix...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.