CVE-2024-4958

The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'import_form_action' function in versions up to, and including, 3.2.0.1. This makes it possible for authenticated attackers, with contributor-level permissions and above, to import a registration form with a default user role of administrator. If an administrator approves or publishes a post or page with the shortcode to the imported form, any user can register as an administrator.

• CWE-862

• https://plugins.trac.wordpress.org/changeset/3095484/user-registration/tags/3.2.1/includes/class-ur-ajax.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/710574a8-a6e2-4ee6-9ea7-03a34994fec7?source=cve
• https://plugins.trac.wordpress.org/changeset/3095484/user-registration/tags/3.2.1/includes/class-ur-ajax.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/710574a8-a6e2-4ee6-9ea7-03a34994fec7?source=cve

Published

Jun 1, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-49571In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-49572A denial of service vulnerability exists in the Modbus TCP f…6.5
• CVE-2024-49573In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-49574Zohocorp ManageEngine ADAudit Plus versions below 8123 are v…8.8
• CVE-2024-49576A use-after-free vulnerability exists in the way Foxit Reade…8.8
• CVE-2024-49579In JetBrains YouTrack before 2024.3.47197 insecure plugin if…6.1
• CVE-2024-49580In JetBrains Ktor before 2.3.13 improper caching in HttpCach…5.3
• CVE-2024-49581Restricted Views backed objects (OSV1) could be bypassed und…6.5
• CVE-2024-49587Glutton V1 service endpoints were exposed without any authen…9.1
• CVE-2024-49588Multiple endpoints in `oracle-sidecar` in versions 0.347.0 t…6.8
• CVE-2024-49589Foundry Artifacts was found to be vulnerable to a Denial Of …6.5
• CVE-2024-4959The Frontend Checklist WordPress plugin through 2.3.2 does n…4.8