CVE-2021-24649: WP User Frontend < 3.5.29 - Obscure Registration as Admin

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-11-21 · updated 2026-06-17

Description

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin

Affected products

weDevs WP User Frontend: before 3.5.29 — fixed in 3.5.29

How to fix

Upgrade to a fixed version: weDevs WP User Frontend 3.5.29. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24649 or the next vulnerability affects your stack