New User Approve
Monthly
Missing Authorization in myCred's New User Approve WordPress plugin through version 3.2.8 permits unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in unauthorized integrity modifications - most likely manipulation of user registration approval states. Reported by Patchstack and assigned a CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, the flaw is exploitable without credentials or user interaction against any WordPress site running the affected plugin. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
The New User Approve plugin for WordPress versions 3.2.3 and earlier contains a missing authorization check that allows authenticated users to modify access control settings beyond their intended privileges. An attacker with basic user credentials could escalate their permissions or alter security configurations without proper authorization. No patch is currently available for this vulnerability.
Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.5.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization in myCred's New User Approve WordPress plugin through version 3.2.8 permits unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in unauthorized integrity modifications - most likely manipulation of user registration approval states. Reported by Patchstack and assigned a CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, the flaw is exploitable without credentials or user interaction against any WordPress site running the affected plugin. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
The New User Approve plugin for WordPress versions 3.2.3 and earlier contains a missing authorization check that allows authenticated users to modify access control settings beyond their intended privileges. An attacker with basic user credentials could escalate their permissions or alter security configurations without proper authorization. No patch is currently available for this vulnerability.
Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.5.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.