CVE-2017-16562
CriticalSummary
The UserPro plugin before version 4.9.17.1 for WordPress, when used on a site with the 'admin' username, allows remote attackers to bypass authentication and gain administrative access by setting the up_auto_log parameter to 'true' in the QUERY_STRING to the default URI.
Risk Assessment
Attackers can gain full access to the admin panel, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update the UserPro plugin to the latest version and change the default 'admin' username to another one to minimize risk.
Original NVD description (English source)
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.