Missing authorization in wpeverest User Registration & Membership – Free & Paid…
Priority LOW 37CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0091 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | up to 3.1.5 | — | No fix listed | CNA |
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Vendorwpeverest Affected up to 3.1.5 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3295
- 2026-10-03 Alias added: GHSA-rwfw-fhxh-hw3q
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/864a3444-0479-4b9f-beca-584a4a9b8682?source=cve
- https://plugins.trac.wordpress.org/browser/user-registration/tags/3.1.5/includes/class-ur-ajax.php#L1111
- https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/class-ur-ajax.php?rev=3070439#L1115
- https://plugins.trac.wordpress.org/changeset/3070439/
More wpeverest vulnerabilities
- TI-2025-00958 Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion CVSS 3.1CRITICAL 9.8
- TI-2026-02850 Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field CVSS 3.1CRITICAL 9.8
- TI-2026-01188 User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration CVSS 3.1CRITICAL 9.8
- TI-2025-02262 User Registration & Membership < 4.1.3 - Authentication Bypass CVSS 3.1HIGH 8.1
- TI-2025-02232 User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation CVSS 3.1HIGH 8.1
- TI-2022-03588 User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload CVSS 3.1HIGH 7.5
Sources
- CVE-2024-3295 · CVE Program
- CVE-2024-3295 · NVD
- FIRST EPSS
- GHSA-rwfw-fhxh-hw3q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences