Critical severity · published Nov 21, 2022
CVE-2021-24649
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created…
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WU
WP User Frontend · Wedevs
before 3.5.29 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24649
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24649
Exploit
https://wpscan.com/vulnerability/9486744e-ab24-44e4-b06e-9e0b4be132e2
More from WP User Frontend
8.8
CVE-2026-81283
WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
8.8
CVE-2021-25076
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to…
7.5
CVE-2026-32485
WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability
7.2
CVE-2024-38693
WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability
6.5
CVE-2026-95525
WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability