Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2021-34621 — Improper Privilege Management in Profilepress

CWE-269 — Improper Privilege ManagementCWE-306 — Missing Authentication for Critical Function6 documents6 sources
Severity
9.8CRITICALNVD
EPSS
93.5%
top 0.18%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Properfraction ProfilepressProfilepress
Timeline
PublishedJul 7
Latest updateMay 24

Description

A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDproperfraction/profilepress3.0.0 — 3.1.3
▶CVEListV5profilepress/profilepress3.0.0 - 3.1.3

🔴Vulnerability Details

2
GHSA
GHSA-h9qm-fw5r-9vmm: A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth↗2022-05-24
▶
VulnCheck
properfraction profilepress Improper Privilege Management↗2021
▶

💥Exploits & PoCs

2
Exploit-DB
WordPress Plugin ProfilePress 3.1.3 - Privilege Escalation (Unauthenticated)↗2021-08-31
▶
Nuclei
WordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation Weakness
▶

🕵️Threat Intelligence

1
Greynoiseio
NoiseLetter October 2025↗
▶