critical9.8Public exploit code
CVE-2017-16562
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain ad…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Userpro < 4.9.17.1 - Authentication Bypass2017-11-04 · webapps · php
Impact
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Userproplugin | Userpro | before 4.9.17.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9
- https://wpvulndb.com/vulnerabilities/8950
- https://www.exploit-db.com/exploits/43117/
- https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9
- https://wpvulndb.com/vulnerabilities/8950
- https://www.exploit-db.com/exploits/43117/