Description
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP User Frontend – Membership, Profile, Registration & Post Submission Plugin for WordPress | 3.5.26 – < 3.5.26 | 3.5.26 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated) EDB-50772 · webapps · Feb 21, 2022
GitHub 1 repository
-
abbarhissarh/CVE-2021-25076 ★ 3 · Jun 4, 2022
Wordpress Plugin WP User Frontend < 3.5.26 - SQL-Injection (Authenticated)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.