CVE-2023-2446mediumexplotación observadaCWE-200

CVE-2023-2446: fallo de gravedad media en UserPro - Community and User Profile WordPress…

UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear UserPro - Community and User Profile WordPress Plugin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

35Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Attendcvss 6.5epss 0.8%
de la publicación al arma
Publicada en NVD22 nov
VulnCheck21 nov
The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Productos afectados
n/a · UserPro - Community and User Profile WordPress Plugin