CVE-2024-1290

6.5 mediumEPSS 0.6%

Medium (6.5) in strategy11 user registration forms. EPSS 0.6% chance of exploitation in the next 30 days.

The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
Published: 2024-03-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

strategy11:user_registration_forms

References

https://wpscan.com/vulnerability/a60187d4-9491-435a-bc36-8dd348a1ffa3/
https://wpscan.com/vulnerability/a60187d4-9491-435a-bc36-8dd348a1ffa3/

Check your stack JSON