WordPress security by component

WordPress User Extra Fields

Plugin description

WordPress User Extra Fields is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Nov 13, 2024; the highest CVE/CNA score is 9.8.

Plugin slug: user-extra-fields

Latest vulnerability

CVE-2024-11150: WordPress User Extra Fields: Code execution

WordPress User Extra Fields is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

PublishedNov 13, 2024

Safe version guidanceSee mitigation notes

		Safe version
Nov 13, 2024	CVE-2024-11150 WordPress User Extra Fields: Code execution WordPress User Extra Fields is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE9.8 NVDPending
Nov 13, 2024	CVE-2024-10800 WordPress User Extra Fields: Privilege escalation or authentication bypass WordPress User Extra Fields is affected by privilege escalation or authentication bypass. Exploitation requires at least subscriber-level access. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE8.8 NVDPending