Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress, f608edf9fc7c567a822fa282b14bd341b67cd8ea

CVE, Research URL: f608edf9fc7c567a822fa282b14bd341b67cd8ea
Home page URL: Security reports for Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Application: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Published on: Sep 09, 2023
Research Description: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar] < 4.13.2 ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice' The ProfilePress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.13.1. This is due to missing or incorrect nonce validation on the 'admin_notice' function. This makes it possible for unauthenticated attackers to dismiss admin notices granted they can trick a site administrator into performing an action such as clicking on a link. The impact of this vulnerability is unknown.
Affected versions: max 4.13.2.
Status: vulnerable

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile &amp; Restrict Content – ProfilePress, f608edf9fc7c567a822fa282b14bd341b67cd8ea