CVE-2024-6069
Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation/Deactivation
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation/Deactivation
| Assigner | Wordfence |
| Reserved | 2024-06-17 |
| Published | 2024-07-09 |
| Updated | 2024-08-01 |
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation/deactivation due to missing capability checks on the pieregister_install_addon, pieregister_activate_addon and pieregister_deactivate_addon functions in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install, activate and deactivate arbitrary plugins. As a result attackers might achieve code execution on the targeted server
| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2024-05-30: | Discovered |
| 2024-07-08: | Disclosed |
Lucio Sá
https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L794
https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L727
https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L761
