Description (CNA)
The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on sites.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SiteSao / DHVC Form | affected 0 through 2.4.7 |
CWE
CWE-266
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d51a0c-c625-4732-b345-df02971fbffa?source=cve
- https://codecanyon.net/item/dhvc-form-wordpress-form-for-visual-composer/8326593
ADP enrichment
No English description supplied.
No references supplied.