Unsafe Default Values Put Admin User Creation at Risk

CVE-2024-9863

What is CVE-2024-9863?

The UserPro plugin for WordPress presents a vulnerability that allows attackers to escalate privileges due to an insecure default setting for the 'default_user_role' option. Versions up to and including 3.6.0 enable unauthenticated users to manipulate the registration process, potentially granting themselves administrator access despite the registration form being disabled. This flaw poses a significant risk for WordPress sites utilizing this plugin, calling for immediate attention for those using affected versions.

References