Login Sign Up

CVE-2023-6009

8.8 HIGH
Authentication Bypass

📋 TL;DR

The UserPro WordPress plugin (versions up to 5.1.4) contains a privilege escalation vulnerability where authenticated users with minimal permissions (like subscribers) can modify their user role to administrator by manipulating the 'wp_capabilities' parameter during profile updates. This affects all WordPress sites using vulnerable versions of the UserPro plugin.

💻 Affected Systems

Products:
  • WordPress UserPro Plugin
Versions: Up to and including 5.1.4
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Requires UserPro plugin to be installed and active. Any WordPress user with profile update capabilities (including subscribers) can potentially exploit this.

📦 What is this software?

Userpro by Userproplugin

View all CVEs affecting Userpro →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain full administrative control over the WordPress site, allowing them to install malicious plugins/themes, modify content, steal data, or establish persistent backdoors.

🟠

Likely Case

Attackers elevate their privileges to administrator and perform unauthorized actions like creating new admin accounts, modifying site settings, or accessing sensitive data.

🟢

If Mitigated

With proper access controls and monitoring, unauthorized privilege changes are detected and reverted before significant damage occurs.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires authenticated access but minimal permissions. Public proof-of-concept demonstrates the attack vector.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5.1.5 or later

Vendor Advisory: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find UserPro plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download latest version from CodeCanyon and manually update.

🔧 Temporary Workarounds

Disable UserPro Plugin

all

Temporarily deactivate the UserPro plugin until patched

wp plugin deactivate userpro

Restrict User Role Changes

all

Add WordPress filter to prevent unauthorized capability modifications

Add to theme's functions.php: add_filter('user_has_cap', 'restrict_capability_changes', 10, 4); function restrict_capability_changes($allcaps, $caps, $args, $user) { if (isset($_POST['wp_capabilities'])) { unset($_POST['wp_capabilities']); } return $allcaps; }

🧯 If You Can't Patch

  • Disable the UserPro plugin immediately
  • Implement strict user role monitoring and alerting for unauthorized changes

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → UserPro version. If version is 5.1.4 or lower, you are vulnerable.

Check Version:

wp plugin get userpro --field=version

Verify Fix Applied:

Verify UserPro plugin version is 5.1.5 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

  • Unusual user role changes in WordPress logs
  • Multiple failed login attempts followed by successful login and role change
  • User capabilities being modified via profile update actions

Network Indicators:

  • POST requests to /wp-admin/admin-ajax.php with wp_capabilities parameter
  • Unusual traffic patterns from subscriber-level accounts

SIEM Query:

source="wordpress" AND (event="user_role_change" OR message="*capabilities*" OR message="*userpro_update_user_profile*")

📊 Metadata

CVE ID: CVE-2023-6009
CVSS v3 Score: 8.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: November 22, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON