CVE-2017-16562

NONE EPSS 97.8%

Published Nov 10, 20178y ago · Modified Jun 17, 20262w ago

Published Nov 10, 2017 8y ago

Last Modified Jun 17, 2026 2w ago

Description

The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.

Threat Intelligence

EPSS Exploit Probability

97.8% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-287 Improper Authentication Authentication

Affected Products 1

Vendor	Product	Version	Range
userproplugin	userpro	*	<4.9.17.1

References 3

codecanyon.net https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9

Issue Tracking
wpvulndb.com https://wpvulndb.com/vulnerabilities/8950

Issue TrackingThird Party Advisory
exploit-db.com https://www.exploit-db.com/exploits/43117/

ExploitIssue TrackingThird Party AdvisoryVDB Entry

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.