CVE-2022-4024 Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User Deletion
Unauthenticated attackers can delete arbitrary users and their posts due to missing authorization and CSRF checks in the plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-4024?
CVE-2022-4024 is a medium-severity missing authorization vulnerability in Unknown Registration Forms, published on 19 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)
Which versions are affected by CVE-2022-4024?
It affects 1 product.
Products include Genetechsolutions Pie Register.
How do I fix CVE-2022-4024?
No fix has been published for CVE-2022-4024 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-4024 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4024 exists.
Other vulnerabilities in Unknown Registration Forms
- CVE-2024-27957 WordPress Pie Register plugin <= 3.8.3.1 - Unauthenticated Arbitrary File Upload vulnerability
- CVE-2021-24731 Pie Register < 3.7.1.6 - Unauthenticated SQL Injection
- CVE-2019-15659 SQL injection in n/a
- CVE-2018-10969 SQL injection in n/a
- CVE-2021-24647 Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
Sources
Also known as GHSA-pvr2-2hwp-5vqc.