CVE-2024-1290: Formidable Registration < 2.12 - Contributor+ Arbitrary User Password Reset To Account Takeover
Published Mar 11, 2024
·Updated
The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts.
Affected Software
2 affected components
Formidable Registration<2.12
Strategy11 User Registration Forms Wordpress<2.12
Event History
Mar 11, 2024
CVE Published
via MITRE·05:56 PM
Data Sourced
via MITRE·05:56 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-1290?
CVE-2024-1290 is considered a critical vulnerability due to its potential for account takeover.
2
How do I fix CVE-2024-1290?
To fix CVE-2024-1290, update the affected User Registration plugin to version 2.12 or later.
3
What is affected by CVE-2024-1290?
CVE-2024-1290 affects the User Registration plugin for WordPress versions prior to 2.12.
4
Who can exploit CVE-2024-1290?
Users with at least the contributor role can exploit CVE-2024-1290 to render sensitive shortcodes.
5
What can attackers do with CVE-2024-1290?
Attackers can use CVE-2024-1290 to generate and leak valid password reset URLs, leading to potential account hijacking.