CVE-2024-0701

The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the plugin's General settings. This makes it possible for unauthenticated attackers to register an account even when account registration has been disabled by an administrator.

The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the plugin's General settings. This makes it possible for unauthenticated attackers to register an account even when account registration has been disabled by an administrator.

El complemento UserPro para WordPress es vulnerable a la omisión de funciones de seguridad en todas las versiones hasta la 5.1.6 incluida. Esto se debe al uso de restricciones del lado del cliente para aplicar la función de Membresía "Registro deshabilitado" dentro de la configuración general del complemento. Esto hace posible que atacantes no autenticados registren una cuenta incluso cuando un administrador haya desactivado el registro de la cuenta.