Vulnerability · Published Nov 8, 2021 · Assigned by WPScan
CVE-2021-24647Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
High 8.1
In plain English
A high-severity improper authentication in Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.8% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes | 3.1.7.6 – before 3.1.7.6 |
Weakness: CWE-287