CVE-2024-6069

HIGH

WordPress Registration Forms <3.8.3.4 - Command Injection

Title source: llm
STIX 2.1

Description

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins. As a result attackers might achieve code execution on the targeted server

References (5)

Core 5

Scores

CVSS v3 8.8
EPSS 0.0063
EPSS Percentile 45.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-862
Status published
Products (2)
genetechproducts/Pie Register – User Registration, Profiles & Content Restriction < 3.8.3.4
genetechproducts/Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction < 3.8.3.4
Published Jul 09, 2024
Tracked Since Feb 18, 2026