Sensitive Information Exposure in User Registration Plugin for WordPress
CVE-2023-3371
5.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 27 June 2023
What is CVE-2023-3371?
The User Registration plugin for WordPress suffers from a vulnerability that allows attackers to expose sensitive information due to a hardcoded encryption key in the 'lock_content_form_handler' and 'display_password_form' functions. This flaw affects versions up to and including 3.7.3, enabling unauthenticated users to decrypt and gain access to password-protected content without authorization. Users are advised to update their plugin to mitigate the risk associated with this vulnerability.
Affected Version(s)
EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor * <= 3.7.3