WPFront User Role Editor, CVE-2024-2931

CVE, Research URL: CVE-2024-2931
Home page URL: Security reports for WPFront User Role Editor
Application: WPFront User Role Editor
Published on: Apr 02, 2024
Research Description: The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.1.11184 via the wpfront_user_role_editor_assign_roles_user_autocomplete AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract retrieve a list of all user email addresses who are registered on the site.
Affected versions: max 4.1.0.
Status: vulnerable