CVE-2023-3343

The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input from the 'profile-pic-url' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

• CWE-502

• https://plugins.trac.wordpress.org/browser/user-registration/tags/3.0.1/includes/functions-ur-core.php#L3156Patch
• https://plugins.trac.wordpress.org/changeset/2932199/user-registration/trunk/includes/functions-ur-core.php#file0Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3590277a-3319-4707-b728-d75ea59e8ad9?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/user-registration/tags/3.0.1/includes/functions-ur-core.php#L3156Patch
• https://plugins.trac.wordpress.org/changeset/2932199/user-registration/trunk/includes/functions-ur-core.php#file0Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3590277a-3319-4707-b728-d75ea59e8ad9?source=cveThird Party Advisory

Published

Jul 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3341The code that processes control channel messages sent to `na…7.5
• CVE-2023-33410Minical 1.0.0 and earlier contains a CSV injection vulnerabi…8.8
• CVE-2023-33411A web server in the Intelligent Platform Management Interfac…7.5
• CVE-2023-33412The web interface in the Intelligent Platform Management Int…8.8
• CVE-2023-33413The configuration functionality in the Intelligent Platform …8.8
• CVE-2023-3342The User Registration plugin for WordPress is vulnerable to …9.9
• CVE-2023-33438A stored Cross-site scripting (XSS) vulnerability in Wolters…5.4
• CVE-2023-33439Sourcecodester Faculty Evaluation System v1.0 is vulnerable …7.2
• CVE-2023-3344The Auto Location for WP Job Manager via Google WordPress pl…4.8
• CVE-2023-33440Sourcecodester Faculty Evaluation System v1.0 is vulnerable …7.2
• CVE-2023-33443Incorrect access control in the administrative functionaliti…9.8
• CVE-2023-3345The LMS by Masteriyo WordPress plugin before 1.6.8 does not …6.5