Exploitation Summary
CVE-2017-16562 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Colette Chamberland.
AI-analyzed exploit summary This is a writeup describing an authentication bypass vulnerability in the Userpro WordPress plugin (versions <= 4.6.17). The exploit involves appending `?up_auto_log=true` to the target URL, which logs the attacker in as the default 'admin' user if it exists.
Description
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
Exploits (1)
This is a writeup describing an authentication bypass vulnerability in the Userpro WordPress plugin (versions <= 4.6.17). The exploit involves appending `?up_auto_log=true` to the target URL, which logs the attacker in as the default 'admin' user if it exists.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H