Medium severity6.5NVD Advisory· Published Mar 11, 2024· Updated Jun 17, 2026

CVE-2024-1290

Description

The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Strategy11/User Registration Forms
cpe:2.3:a:strategy11:user_registration_forms:*:*:*:*:*:wordpress:*:*
Range: <2.12
WordPress/User Registrationcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2.12
Package: https://wordpress.org/plugins/user-registration

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/a60187d4-9491-435a-bc36-8dd348a1ffa3/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000