CVEs-PoC/2021/CVE-2021-24647.md

### [CVE-2021-24647](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24647)
![](https://img.shields.io/static/v1?label=Product&message=Registration%20Forms%20%E2%80%93%20User%20profile%2C%20Content%20Restriction%2C%20Spam%20Protection%2C%20Payment%20Gateways%2C%20Invitation%20Codes&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=3.1.7.6%3C%203.1.7.6%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brighgreen)

### Description

The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username

### POC

#### Reference
- https://wpscan.com/vulnerability/40d347b1-b86e-477d-b4c6-da105935ce37

#### Github
- https://github.com/RandomRobbieBF/CVE-2021-24647