CVE-2017-16562 UserPro <= 4.9.17 - Authentication Bypass
CriticalCVSS 9.8
EPSS 27.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| userproplugin userpro | < 4.9.17.1 | 4.9.17.1 |
| wordpress userpro(WordPress) | < 4.9.17.1 | 4.9.17.1 |
References
- codecanyon.net issue-tracking
- wpvulndb.com issue-tracking third-party-advisory
- 43117 exploit issue-tracking third-party-advisory vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org