Medium severity6.5NVD Advisory· Published May 2, 2024· Updated Apr 15, 2026
CVE-2024-3295
CVE-2024-3295
Description
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file.
Affected products
1- Range: <=3.1.5
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- plugins.trac.wordpress.org/browser/user-registration/tags/3.1.5/includes/class-ur-ajax.phpnvd
- plugins.trac.wordpress.org/browser/user-registration/trunk/includes/class-ur-ajax.phpnvd
- plugins.trac.wordpress.org/changeset/3070439/nvd
- www.wordfence.com/threat-intel/vulnerabilities/id/864a3444-0479-4b9f-beca-584a4a9b8682nvd
News mentions
0No linked articles in our index yet.