CVE-2023-3342
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to and including 3.0.2. This allows authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server.
Risk Assessment
Attackers could exploit this vulnerability to upload malicious code, potentially leading to remote code execution on the server, jeopardizing the security of the entire organization.
Recommendation
It is recommended to update the plugin to version 3.0.2.1 or later to mitigate this vulnerability and conduct a security audit of the server.
Original NVD description (English source)
The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in version 3.0.2 and fully patched in version 3.0.2.1.