CVE-2021-34621

What it actually does

CVE-2021-34621 is an unauthenticated authentication and authorization bypass in the ProfilePress WordPress plugin registration workflow, specifically in the user registration logic under RegistrationAuth.php. In affected versions 3.0.0 through 3.1.3, attacker-controlled registration input can cause a newly created account to be assigned the administrator role instead of a low-privilege subscriber/customer role. Because the issue is network-accessible, requires no prior authentication, and requires no user interaction, successful exploitation gives the attacker full WordPress administrative control, including the ability to change site content, install plugins, upload web shells through legitimate admin features, create additional privileged users, access sensitive data stored in WordPress, and disrupt site availability.

Why it matters to the business

A public WordPress site running an affected ProfilePress version can be fully taken over by an unauthenticated attacker. Operational consequences include website defacement, malware or SEO spam injection, theft of user or customer data stored in WordPress, installation of persistence mechanisms, abuse of the site for phishing or redirects, and potential pivoting into connected hosting or business systems. The CVSS score is critical and EPSS is high, with weaponized exploitation maturity, so exposed sites should be treated as high-priority even though this vulnerability is not listed in CISA KEV.

How an attack unfolds

An attacker first identifies a WordPress site using ProfilePress 3.0.0 through 3.1.3, typically by checking exposed plugin assets or WordPress plugin metadata. The attacker then submits a crafted registration request to the site’s ProfilePress-powered registration endpoint or associated WordPress AJAX/registration handler. Due to flawed authorization handling in the registration component, the request can influence the role assigned to the new account and cause it to be created with administrator privileges. The attacker logs in using the newly registered account, accesses the WordPress admin dashboard, and then performs post-exploitation actions such as creating backup admin users, installing malicious plugins or themes, modifying PHP files where allowed, changing site content, exfiltrating data, or redirecting visitors to attacker-controlled infrastructure.

How to fix it

Upgrade ProfilePress immediately to a non-vulnerable release newer than 3.1.3, preferably the latest version available from the vendor or WordPress plugin repository. If an immediate upgrade is not possible, disable or remove the ProfilePress plugin until it can be updated. Review and harden WordPress registration settings, disabling public registration where it is not required. Remove any unexpected administrator accounts and rotate credentials for legitimate administrators after cleanup. If compromise is suspected, perform a full WordPress integrity review, including plugins, themes, uploaded files, scheduled tasks, and recently modified PHP files.

How to confirm the fix worked

Confirm the installed ProfilePress version is not 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.1, 3.1.2, or 3.1.3. Validate through the WordPress admin plugin page, command-line WordPress tooling where available, or by inspecting installed plugin metadata. Attempted validation should also confirm that unauthenticated public registration cannot create privileged users. After patching, review all current administrator accounts and verify that each is expected, approved, and created through legitimate administrative activity.

Typical attack path

1. Scan for WordPress sites exposing ProfilePress plugin assets or version information.
2. Confirm the installed ProfilePress version is within the vulnerable 3.0.0 through 3.1.3 range.
3. Submit a crafted unauthenticated registration request that causes the created user to receive administrator privileges.
4. Log in to WordPress using the attacker-created administrator account.
5. Establish persistence by creating additional admin users, installing plugins, or modifying site files where permissions allow.
6. Abuse administrative access to deface the site, inject malware, steal data, redirect traffic, or maintain long-term access.

How to detect it

To determine whether exploitation already occurred, review WordPress audit logs, web server access logs, authentication logs, plugin logs, and hosting file modification records around the exposure window. Look for unauthenticated registration requests followed shortly by successful logins to the WordPress admin area from the same IP address or user agent. Investigate any administrator account created during the vulnerable period, especially accounts with unfamiliar usernames, disposable email addresses, unusual creation times, or no corresponding helpdesk/change record. Examine access logs for POST requests to WordPress registration, AJAX, ProfilePress, or plugin-specific endpoints preceding admin dashboard access. After any suspicious admin creation, review file integrity and modification timestamps for plugins, themes, wp-content uploads, and other writable directories. Also check for newly installed plugins or themes, unexpected redirects, injected scripts, unfamiliar PHP files, and repeated login activity from hosting providers, VPNs, proxies, or foreign geographies inconsistent with normal administration.

• /wp-content/plugins/profilepress/
• /wp-content/plugins/wp-user-avatar/
• /src/Classes/RegistrationAuth.php
• POST /wp-admin/admin-ajax.php
• POST /wp-login.php?action=register
• POST /wp-admin/
• /wp-admin/user-new.php
• /wp-admin/plugins.php
• /wp-admin/theme-editor.php
• /wp-admin/plugin-editor.php
• administrator
• ProfilePress

What your security team should do

• Prioritize remediation for all internet-facing WordPress sites running ProfilePress because the vulnerability is critical, unauthenticated, and weaponized.
• Upgrade ProfilePress to the latest available version or disable the plugin until the upgrade is complete.
• Inventory WordPress sites for affected ProfilePress versions 3.0.0 through 3.1.3, including sites where the plugin may be installed under legacy or renamed plugin paths.
• Review recently created WordPress administrator accounts and immediately remove any that are unauthorized or unexplained.
• Reset passwords and invalidate active sessions for legitimate administrator accounts if suspicious privileged account creation is found.
• Search web access logs and WordPress audit logs for suspicious registration activity followed by administrative login activity.
• Inspect the site for post-compromise artifacts such as unfamiliar plugins, modified theme files, unknown PHP files in upload directories, malicious redirects, injected JavaScript, and newly added scheduled jobs.
• Place administrative interfaces behind additional access controls such as MFA, IP allowlisting, or a web application firewall where operationally feasible.