Sensitive Information Disclosure in UserPro WordPress Plugin

CVE-2023-2446

What is CVE-2023-2446?

The UserPro plugin for WordPress has a vulnerability that permits authenticated attackers with subscriber-level access to exploit the 'userpro' shortcode, leading to the unintended disclosure of sensitive user meta values. This exposure arises from inadequate restrictions imposed on these values, potentially enabling adversaries to obtain critical user information that could facilitate unauthorized access to higher-privileged accounts. Users should update to the latest version to mitigate potential risks.

References