SB2023112712 - Multiple vulnerabilities in UserPro plugin for WordPress

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Authorization (CVE-ID: CVE-2023-6007)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to a missing capability check on multiple functions. A remote attacker can add, modify or delete user meta and plugin options.

2) Cross-site request forgery (CVE-ID: CVE-2023-6008)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Remediation

Install update from vendor's website.

References

• https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4f8798-c0f9-4d05-808e-375864a0ad95?source=cve
• https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6e2b9e-3d70-4c07-a779-45164816b89c?source=cve