blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-6069

HIGH 8.8 CVSS 3.1
Published
July 9, 2024
Last modified
June 17, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins. As a result attackers might achieve code execution on the targeted server

Affected WordPress components

  • Pie Register – User Registration, Profiles & Content Restriction Plugin · pie-register
    Confirmed match Active
    Up to and including 3.8.3.4
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • genetechproducts Pie Register – User Registration, Profiles & Content Restriction — Up to and including 3.8.3.4
  • genetech_products registration_forms — Up to and including 3.8.3.4
  • genetech_products user_registration_forms — Up to and including 3.8.3.4
  • genetech_products front_end_user_profile_login_form — Up to and including 3.8.3.4
  • genetech_products invitation_based_registrations — Up to and including 3.8.3.4
  • genetech_products content_registration — Up to and including 3.8.3.4

References