The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'import_settings' function. This makes it possible for unauthenticated attackers to exploit PHP Object Injection due to the use of unserialize() on the user supplied parameter via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HUserproplugin Userpro
APPUserproplugin≤ 5.1.0
Powiązane podatności
Incorrect Privilege Assignment w wtyczce WordPress UserPro — przejęcie konta bez uwierzytelnienia
Pominięcie uwierzytelnienia w pluginie UserPro dla WordPress (logowanie Facebook)
Nieautoryzowany reset hasła w pluginie UserPro dla WordPress
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote...
The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,...