Executive Summary

The Users manager – PN plugin for WordPress has a vulnerability that allows privilege escalation through arbitrary user meta updates. This happens because the authorization logic in the userspn_ajax_nopriv_server() function is flawed. Specifically, the function only blocks unauthenticated users when the user_id is empty. However, if a non-empty user_id is provided, the check is bypassed, allowing the attacker to update any user's metadata without authentication or authorization.

Additionally, the security nonce ('userspn-nonce') intended to protect this AJAX endpoint is exposed publicly to all visitors, making the nonce check ineffective. This combination allows unauthenticated attackers to modify arbitrary user metadata, including sensitive fields like userspn_secret_token.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows unauthenticated attackers to escalate privileges by modifying user metadata arbitrarily. Attackers could potentially change sensitive information or tokens associated with user accounts, leading to unauthorized access, data manipulation, or further compromise of the WordPress site.

Given the CVSS score of 9.8, the impact includes high confidentiality, integrity, and availability risks, meaning attackers can fully compromise user data and site functionality.

Useful 0 Not Useful 0