Userplus User Registration User Profile Userplus vulnerabilities

CVE-2024-9518 [CRITICAL] CWE-269 CVE-2024-9518: The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and inclu The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to insufficient restriction on the 'form_actions' and 'userplus_update_user_profile' functions. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.

CVE-2024-9519 [HIGH] CWE-266 CVE-2024-9519: The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an impro The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update the registration form role to administrator, which leads

CVE-2024-9520 [MEDIUM] CWE-862 CVE-2024-9520: The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of da The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, to add, modify, or delete user meta and plugin options.