Description
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes | 3.1.7.6 – < 3.1.7.6 | 3.1.7.6 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
RandomRobbieBF/CVE-2021-24647 ★ 1 · Jun 15, 2023
CVE-2021-24647 Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login http/cves/2021/CVE-2021-24647.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.