Description
The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | UserPro - Community and User Profile WordPress Plugin | unaffected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-33931 | The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2025-02-13T16:44:15.033Z
Reserved: 2023-05-01T14:17:16.045Z
Link: CVE-2023-2446
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-11-22T08:15:07.020
Modified: 2024-11-21T07:58:37.950
Link: CVE-2023-2446
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses