2 lines
5.1 KiB
JSON
2 lines
5.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Users manager – PN","vendor":"felixmartinez","versions":[{"lessThanOrEqual":"1.1.15","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15. This is due to a flawed authorization logic check in the userspn_ajax_nopriv_server() function within the 'userspn_form_save' case. The conditional only blocks unauthenticated users when the user_id is empty, but when a non-empty user_id is supplied, execution bypasses this check entirely and proceeds to update arbitrary user meta via update_user_meta() without any authentication or authorization verification. Additionally, the nonce required for this AJAX endpoint ('userspn-nonce') is exposed to all visitors via wp_localize_script on the public wp_enqueue_scripts hook, rendering the nonce check ineffective as a security control. This makes it possible for unauthenticated attackers to update arbitrary user metadata for any user account, including the userspn_secret_token field."},{"lang":"es","value":"El plugin Users manager - PN para WordPress es vulnerable a escalada de privilegios a través de la actualización arbitraria de metadatos de usuario en todas las versiones hasta la 1.1.15 inclusive. Esto se debe a una verificación de lógica de autorización defectuosa en la función userspn_ajax_nopriv_server() dentro del caso 'userspn_form_save'. La condicional solo bloquea a usuarios no autenticados cuando el user_id está vacío, pero cuando se proporciona un user_id no vacío, la ejecución omite esta verificación por completo y procede a actualizar metadatos de usuario arbitrarios a través de update_user_meta() sin ninguna verificación de autenticación o autorización. Además, el nonce requerido para este endpoint AJAX ('userspn-nonce') se expone a todos los visitantes a través de wp_localize_script en el hook público wp_enqueue_scripts, lo que hace que la verificación del nonce sea ineficaz como control de seguridad. Esto hace posible que atacantes no autenticados actualicen metadatos de usuario arbitrarios para cualquier cuenta de usuario, incluyendo el campo userspn_secret_token."}],"id":"CVE-2026-4003","lastModified":"2026-07-24T21:10:00.143","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4003","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-08T14:48:48.869485Z","version":"2.0.3"}}]},"published":"2026-04-08T05:16:06.347","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/userspn/tags/1.0.31/includes/class-userspn-ajax-nopriv.php#L186"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/userspn/tags/1.0.31/includes/class-userspn-ajax-nopriv.php#L190"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/userspn/tags/1.0.31/includes/class-userspn-ajax-nopriv.php#L233"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/userspn/tags/1.0.31/includes/class-userspn-common.php#L168"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/userspn/tags/1.0.31/includes/class-userspn-functions-user.php#L235"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/userspn/trunk/includes/class-userspn-ajax-nopriv.php#L186"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/userspn/trunk/includes/class-userspn-ajax-nopriv.php#L190"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/userspn/trunk/includes/class-userspn-ajax-nopriv.php#L233"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/userspn/trunk/includes/class-userspn-common.php#L168"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/userspn/trunk/includes/class-userspn-functions-user.php#L235"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3491109%40userspn&new=3491109%40userspn&sfp_email=&sfph_mail="},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27bb60c1-43fa-4a18-b9ca-059535b0d5b6?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@wordfence.com","type":"Secondary"}]}
|