CVE-2023-2446mediumobserved exploitationCWE-200

CVE-2023-2446: medium-severity vulnerability in UserPro - Community and User Profile WordPress…

UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode

Published · Updated

Follow this CVE+ Monitor UserPro - Community and User Profile WordPress Plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

35Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendcvss 6.5epss 0.8%
from disclosure to weapon
Published on NVDNov 22
VulnCheckNov 21
The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · UserPro - Community and User Profile WordPress Plugin