Description
The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive user meta.
References (2)
Core 2
Scores
CVSS v3
4.3
EPSS
0.0044
EPSS Percentile
35.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-200
Status
published
Products (2)
easyregistrationforms/Easy Registration Forms
< 2.1.1
easyregistrationforms/easy_registration_forms
< 2.1.1
Published
Sep 23, 2023
Tracked Since
Feb 18, 2026