The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive user meta.
References
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 04:23
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
25 Sep 2023, 13:47
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:easyregistrationforms:easy_registration_forms:*:*:*:*:*:wordpress:*:* | |
| First Time |
Easyregistrationforms
Easyregistrationforms easy Registration Forms |
|
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/562fe11f-36a0-4f23-9eed-50ada7ab2961?source=cve - Third Party Advisory | |
| References | (MISC) https://plugins.trac.wordpress.org/browser/easy-registration-forms/tags/2.1.1/includes/class-user.php#L835 - Patch |
23 Sep 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-23 08:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-5134
Mitre link : CVE-2023-5134
CVE.ORG link : CVE-2023-5134
JSON object : View
Products Affected
easyregistrationforms
- easy_registration_forms
CWE
No CWE.