CVE-2024-2417: Insufficient Information (NVD-CWE-noinfo)
value: The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the form_save_action() function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the registration form and make the default registration role administrator. This subsequently allows the attacker to register an account as an administrator on the site.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2024-05-02T17:15Z
Repository: https://github.com/wpeverest/user-registration
Language: PHP
Files changed: includes/class-ur-ajax.php
Commit date: 2024-04-11 09:32:28 +0545
Commit message: Security - Vulnerability issue while saving form and removing profile picture

Diff: diff --git a/includes/class-ur-ajax.php b/includes/class-ur-ajax.php
index 84750c5d..0b172893 100644
--- a/includes/class-ur-ajax.php
+++ b/includes/class-ur-ajax.php
@@ -52,11 +52,11 @@ class UR_AJAX {
 			'user_input_dropped'        => true,
 			'form_save_action'          => false,
 			'user_form_submit'          => true,
 			'update_profile_details'    => true,
 			'profile_pic_upload'        => true,
-			'profile_pic_remove'        => true,
+			'profile_pic_remove'        => false,
 			'ajax_login_submit'         => true,
 			'send_test_email'           => true,
 			'rated'                     => false,
 			'dashboard_widget'          => false,
 			'dismiss_notice'            => false,
@@ -803,10 +803,14 @@ class UR_AJAX {
 	public static function form_save_action() {
 
 		try {
 			check_ajax_referer( 'ur_form_save_nonce', 'security' );
 
+			if ( ! current_user_can( 'manage_options' ) ) {
+				throw new Exception( __( "You don't have enough permission to perform this task. Please contact the Administrator.", 'user-registration' ) );
+			}
+
          if ( ! isset( $_POST['data'] ) || ( isset( $_POST['data'] ) && gettype( wp_unslash( $_POST['data'] ) ) != 'array' ) ) { //phpcs:ignore
 				throw new Exception( __( 'post data not set', 'user-registration' ) );
 			} elseif ( ! isset( $_POST['data']['form_data'] )
 			|| ( isset( $_POST['data']['form_data'] )
          && gettype( wp_unslash( $_POST['data']['form_data'] ) ) != 'string' ) ) { //phpcs:ignore
@@ -1122,22 +1126,38 @@ class UR_AJAX {
 			);
 		}
 
 		$attachment_id = isset( $_POST['attachment_id'] ) ? intval( wp_unslash( $_POST['attachment_id'] ) ) : '';
 
-		if ( file_exists( get_attached_file( $attachment_id ) ) && ! unlink( get_attached_file( $attachment_id ) ) ) {
+		if ( is_user_logged_in() ) {
+			$user_id             = get_current_user_id();
+			$user_profile_pic_id = get_user_meta( $user_id, 'user_registration_profile_pic_url' );
+
+			if ( $user_profile_pic_id == $attachment_id ) {
+
+				if ( file_exists( get_attached_file( $attachment_id ) ) && ! unlink( get_attached_file( $attachment_id ) ) ) {
+					wp_send_json_error(
+						array(
+							'message' => esc_html__( 'File cannot be removed', 'user-registration' ),
+						)
+					);
+				}
+					update_user_meta( $user_id, 'user_registration_profile_pic_url', '' );
+			} else {
+				wp_send_json_error(
+					array(
+						'message' => esc_html__( 'File cannot be removed', 'user-registration' ),
+					)
+				);
+			}
+		} else {
 			wp_send_json_error(
 				array(
 					'message' => esc_html__( 'File cannot be removed', 'user-registration' ),
 				)
 			);
-		}
-
-		$user_id = get_current_user_id();
 
-		if ( $user_id > 0 ) {
-			update_user_meta( $user_id, 'user_registration_profile_pic_url', '' );
 		}
 
 		wp_send_json_success(
 			array(
 				'message' => __( 'User profile picture removed successfully', 'user-registration' ),

Vulnerable code: 			'profile_pic_remove'        => true,
		if ( file_exists( get_attached_file( $attachment_id ) ) && ! unlink( get_attached_file( $attachment_id ) ) ) {
		}

		$user_id = get_current_user_id();
		if ( $user_id > 0 ) {
			update_user_meta( $user_id, 'user_registration_profile_pic_url', '' );
Fixed code: 			'profile_pic_remove'        => false,
			if ( ! current_user_can( 'manage_options' ) ) {
				throw new Exception( __( "You don't have enough permission to perform this task. Please contact the Administrator.", 'user-registration' ) );
			}

		if ( is_user_logged_in() ) {
			$user_id             = get_current_user_id();
			$user_profile_pic_id = get_user_meta( $user_id, 'user_registration_profile_pic_url' );

			if ( $user_profile_pic_id == $attachment_id ) {

				if ( file_exists( get_attached_file( $attachment_id ) ) && ! unlink( get_attached_file( $attachment_id ) ) ) {
					wp_send_json_error(
						array(
							'message' => esc_html__( 'File cannot be removed', 'user-registration' ),
						)
					);
				}
					update_user_meta( $user_id, 'user_registration_profile_pic_url', '' );
			} else {
				wp_send_json_error(
					array(
						'message' => esc_html__( 'File cannot be removed', 'user-registration' ),
					)
				);
			}
		} else {