Unauthorized Data Modification Vulnerability in User Registration Plugin

CVE-2024-4958

Summary

The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin is vulnerable to unauthorized modification of data. Due to a missing capability check in the 'import_form_action' function, authenticated attackers with contributor-level permissions and above can import a registration form that defaults the user role to administrator. This vulnerability allows such attackers to escalate their privileges, as any post or page published with a shortcode linked to the imported form can enable any user to register as an administrator. This poses a significant security risk, particularly for WordPress sites utilizing this plugin version.

References