Lucene search
PRIOn knowledge basePRION:CVE-2023-2437HistoryNov 22, 2023 - 4:15 p.m.
Authentication flaw
2023-11-2216:15:00
PRIOn knowledge base
www.prio-n.com
5
authentication flaw
userpro plugin
wordpress
vulnerable
authentication bypass
facebook login
insufficient verification
unauthenticated attackers
administrator
email address
cve-2023-2448
cve-2023-2446
exploit
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. An attacker can leverage CVE-2023-2448 and CVE-2023-2446 to get the user’s email address to successfully exploit this vulnerability.
Related
cvelist
cvelist
nvd
nvd
cve
cve
wpvulndb
wpvulndb
UserPro < 5.1.2 - Authentication Bypass to Administrator
2023-11-23 00:00:00
UserPro < 5.1.5 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template
2023-11-23 00:00:00
UserPro < 5.1.2 - Insecure Password Reset Mechanism
2023-11-23 00:00:00
wordfence
wordfence
Several Critical Vulnerabilities including Privilege Escalation, Authentication Bypass, and More Patched in UserPro WordPress Plugin
2023-11-21 19:26:31
Wordfence Intelligence Weekly WordPress Vulnerability Report (November 20, 2023 to November 26, 2023)
2023-11-30 15:31:16
2023’s Critical WordPress Vulnerabilities and How They Work
2024-02-12 19:11:21
prion
prion
Design/Logic Flaw
2023-11-22 16:15:00
Sql injection
2023-11-22 16:15:00
Information disclosure
2023-11-22 08:15:00
packetstorm
packetstorm
WordPress UserPro 5.1.x Password Reset / Authentication Bypass / Escalation
2023-11-22 00:00:00
zdt
zdt
githubexploit
githubexploit
Exploit for Improper Authentication in Userproplugin Userpro
2024-03-02 21:09:07