CVE-2024-1290: Formidable Registration < 2.12 - Contributor+ Arbitrary User Password Reset To Account Takeover

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-03-11 · updated 2026-06-17

Description

The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts.

Affected products

Strategy11 User Registration Forms: before 2.12 — fixed in 2.12

How to fix

Upgrade to a fixed version: Strategy11 User Registration Forms 2.12. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/a60187d4-9491-435a-bc36-8dd348a1ffa3/
https://wpscan.com/vulnerability/a60187d4-9491-435a-bc36-8dd348a1ffa3/

Get alerted when CVE-2024-1290 or the next vulnerability affects your stack