157 lines
7.1 KiB
JSON
157 lines
7.1 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-4003",
|
||
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Wordfence",
|
||
"dateReserved": "2026-03-11T18:52:48.888Z",
|
||
"datePublished": "2026-04-08T03:36:08.200Z",
|
||
"dateUpdated": "2026-04-08T16:42:58.430Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
||
"shortName": "Wordfence",
|
||
"dateUpdated": "2026-04-08T16:42:58.430Z"
|
||
},
|
||
"affected": [
|
||
{
|
||
"vendor": "felixmartinez",
|
||
"product": "Users manager – PN",
|
||
"versions": [
|
||
{
|
||
"version": "0",
|
||
"status": "affected",
|
||
"lessThanOrEqual": "1.1.15",
|
||
"versionType": "semver"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15. This is due to a flawed authorization logic check in the userspn_ajax_nopriv_server() function within the 'userspn_form_save' case. The conditional only blocks unauthenticated users when the user_id is empty, but when a non-empty user_id is supplied, execution bypasses this check entirely and proceeds to update arbitrary user meta via update_user_meta() without any authentication or authorization verification. Additionally, the nonce required for this AJAX endpoint ('userspn-nonce') is exposed to all visitors via wp_localize_script on the public wp_enqueue_scripts hook, rendering the nonce check ineffective as a security control. This makes it possible for unauthenticated attackers to update arbitrary user metadata for any user account, including the userspn_secret_token field."
|
||
}
|
||
],
|
||
"title": "Users manager – PN <= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Action",
|
||
"references": [
|
||
{
|
||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27bb60c1-43fa-4a18-b9ca-059535b0d5b6?source=cve"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/userspn/trunk/includes/class-userspn-ajax-nopriv.php#L233"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/userspn/tags/1.0.31/includes/class-userspn-ajax-nopriv.php#L233"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/userspn/trunk/includes/class-userspn-ajax-nopriv.php#L186"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/userspn/tags/1.0.31/includes/class-userspn-ajax-nopriv.php#L186"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/userspn/trunk/includes/class-userspn-ajax-nopriv.php#L190"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/userspn/tags/1.0.31/includes/class-userspn-ajax-nopriv.php#L190"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/userspn/trunk/includes/class-userspn-common.php#L168"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/userspn/tags/1.0.31/includes/class-userspn-common.php#L168"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/userspn/trunk/includes/class-userspn-functions-user.php#L235"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/userspn/tags/1.0.31/includes/class-userspn-functions-user.php#L235"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3491109%40userspn&new=3491109%40userspn&sfp_email=&sfph_mail="
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"description": "CWE-862 Missing Authorization",
|
||
"cweId": "CWE-862",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 9.8,
|
||
"baseSeverity": "CRITICAL"
|
||
}
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "HA GIA BAO"
|
||
}
|
||
],
|
||
"timeline": [
|
||
{
|
||
"time": "2026-03-12T22:34:37.000Z",
|
||
"lang": "en",
|
||
"value": "Vendor Notified"
|
||
},
|
||
{
|
||
"time": "2026-04-07T15:32:12.000Z",
|
||
"lang": "en",
|
||
"value": "Disclosed"
|
||
}
|
||
]
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-04-08T14:48:48.869485Z",
|
||
"id": "CVE-2026-4003",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-04-08T16:14:10.743Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |