Login Request a demo
Critical severity · published Jul 13, 2023
CVE-2023-3342
User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload
9.9
CVSS
1.7%
EPSS
No
On KEV
Description
The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in version 3.0.2 and fully patched in version 3.0.2.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UR
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · wpeverest
through 3.0.2 · source: vendor
UR
User Registration · Wpeverest
before 3.0.2.1 · source: NVD, CISA
Affected product
UR
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
wpeverest
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3342
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3342
Exploit
https://lana.codes/lanavdb/c0a58dff-7a5b-4cc0-82d6-2255e61d801c/
Patch
https://plugins.trac.wordpress.org/browser/user-registration/tags/3.0.1/includes/functions-ur-core.php#L3156
Patch
https://plugins.trac.wordpress.org/changeset/2933689/user-registration/trunk/includes/functions-ur-core.php
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/a979e885-f7dd-4616-a881-64f3d97c309d?source=cve
Third Party Advisory
http://packetstormsecurity.com/files/173434/WordPress-User-Registration-3.0.2-Arbitrary-File-Upload.html
More from User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
9.8
CVE-2026-1492
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
8.8
CVE-2024-2417
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
8.8
CVE-2023-3343
User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection
8.1
CVE-2026-92798
User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
8.1
CVE-2026-1779
User Registration & Membership <= 5.1.2 - Authentication Bypass