blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-4024

MEDIUM 6.5 CVSS 3.1
Published
December 19, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-352, CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Description

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)

Affected WordPress components

  • Pie Register – User Registration, Profiles & Content Restriction Plugin · pie-register
    Confirmed match Active
    Before 3.8.1.3
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Registration Forms — Before 3.8.1.3
  • genetechsolutions pie_register — Before 3.8.1.3

References

  • wpscan.com https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record