Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions , CVE-2024-1170

CVE, Research URL: CVE-2024-1170
Home page URL: Security reports for Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions
Application: Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions
Published on: Mar 07, 2024
Research Description: The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the handle_deleted_media function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to delete arbitrary media files.
Affected versions: Min -, max 2.8.8.
Status: vulnerable

Post Form &#8211; Registration Form &#8211; Profile Form for User Profiles &#8211; Frontend Content Forms for User Submissions , CVE-2024-1170