CVE-2023-6007
📋 TL;DR
The UserPro WordPress plugin has a missing capability check vulnerability that allows unauthenticated attackers to add, modify, or delete user metadata and plugin options. This affects all versions up to and including 5.1.1. Any WordPress site using the vulnerable UserPro plugin is at risk.
💻 Affected Systems
- UserPro WordPress Plugin
📦 What is this software?
Userpro by Userproplugin
⚠️ Risk & Real-World Impact
Worst Case
Attackers could compromise all user accounts, steal sensitive data, deface websites, or take complete control of the WordPress installation.
Likely Case
Attackers will modify user profiles, steal personal information, inject malicious content, or disrupt site functionality.
If Mitigated
With proper access controls and monitoring, impact would be limited to attempted attacks that are detected and blocked.
🎯 Exploit Status
Simple HTTP requests can trigger the vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.1.2 or later
Vendor Advisory: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find UserPro plugin. 4. Click 'Update Now' if available. 5. If not, download latest version from CodeCanyon and manually update.
🔧 Temporary Workarounds
Disable UserPro Plugin
allTemporarily deactivate the vulnerable plugin until patched.
wp plugin deactivate userpro
Web Application Firewall Rule
allBlock requests to UserPro endpoints from unauthenticated users.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the WordPress site.
- Enable detailed logging and monitoring for suspicious UserPro-related activity.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > UserPro version number. If version is 5.1.1 or lower, you are vulnerable.Check Version:
wp plugin get userpro --field=versionVerify Fix Applied:
After updating, confirm UserPro plugin version is 5.1.2 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with userpro_action parameters from unauthenticated IPs
- Unexpected modifications to wp_usermeta table
Network Indicators:
- HTTP requests to UserPro endpoints without authentication cookies
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php" AND query_string="*userpro_action*") AND NOT user_agent="*bot*"🔗 References
- https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4f8798-c0f9-4d05-808e-375864a0ad95?source=cve
- https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4f8798-c0f9-4d05-808e-375864a0ad95?source=cve
