Skip to content
OpenAdvisories
Medium · 6.5 CVE-2024-3295 EUVD-2024-31885GHSA-rwfw-fhxh-hw3q

User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion

Published May 2, 2024 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: WPEverest Product: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Category: Web / CMS

Description

The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file.

Affected products

VendorProductAffectedFixed
wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder ≤ 3.1.5 —

References