CVE-2023-2449

The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_process_form). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-2448 and CVE-2023-2446, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.

• CWE-620

• https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/de9be7bc-4f8a-4393-8ebb-1b1f141b7585?source=cveThird Party Advisory
• http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.htmlThird Party Advisory, VDB Entry
• https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/de9be7bc-4f8a-4393-8ebb-1b1f141b7585?source=cveThird Party Advisory

Published

Nov 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24484A malicious user can cause log files to be written to a dire…5.5
• CVE-2023-24485Vulnerabilities have been identified that, collectively, all…7.8
• CVE-2023-24486A vulnerability has been identified in Citrix Workspace app …5.5
• CVE-2023-24487Arbitrary file read in Citrix ADC and Citrix Gateway 7.5
• CVE-2023-24488Cross site scripting vulnerability in Citrix ADC and Citrix …6.1
• CVE-2023-24489A vulnerability has been discovered in the customer-managed …9.8
• CVE-2023-24490Users with only access to launch VDA applications can launch…4.3
• CVE-2023-24491 A vulnerability has been discovered in the Citrix Secure Ac…7.8
• CVE-2023-24492 A vulnerability has been discovered in the Citrix Secure Ac…8.8
• CVE-2023-24493A formula injection vulnerability exists in Tenable.sc due t…5.7
• CVE-2023-24494A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2023-24495A Server Side Request Forgery (SSRF) vulnerability exists in…6.5