Medium severity6.5NVD Advisory· Published May 2, 2024· Updated Jun 17, 2026
CVE-2024-3295
CVE-2024-3295
Description
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<=3.1.5+ 1 more
- (no CPE)range: <=3.1.5
- (no CPE)range: <=3.1.5
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/browser/user-registration/tags/3.1.5/includes/class-ur-ajax.phpnvd
- plugins.trac.wordpress.org/browser/user-registration/trunk/includes/class-ur-ajax.phpnvd
- plugins.trac.wordpress.org/changeset/3070439/nvd
- www.wordfence.com/threat-intel/vulnerabilities/id/864a3444-0479-4b9f-beca-584a4a9b8682nvd
News mentions
0No linked articles in our index yet.