漏洞标题
N/A
漏洞描述信息
WordPress 的 User Profile & User Registration Forms 插件在版本到 3.9.0 之间容易受到通过 [user_meta] 短代码泄露敏感信息的影响。这是因为对通过该短代码调用的敏感用户元数据的限制不足。这使得具有订阅级别权限的认证攻击者以及更高级别的用户可以检索可用于获取高特权用户账户访问的敏感用户元数据。这确实需要启用 Usermeta 短代码来进行利用。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
漏洞类别
N/A
漏洞标题
WordPress Plugin Profile Builder - User Profile & User Registration Forms 信息泄露漏洞
漏洞描述信息
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin Profile Builder - User Profile & User Registration Forms 3.9.0及之前版本存在信息泄露漏洞。攻击者利用该漏洞可以检索敏感数据。
CVSS信息
N/A
漏洞类别
信息泄露