Security Issue User Registration (Version 2.1.12)
-
Hi,
The user registration has a security problem! Since about 2 weeks the standard registration form is used to create users who do not meet all criteria for registration!
See the following form data:
Here is the submitted registration form:
Registration date: (empty)
Formular: Default Registration – Formular-ID#: 72
Username: bbasmqzcllm
First Name: bbasmqzcllm
Last Name: bbasmqzcllm
E-mail Address: [email protected]
DSGVO: (empty)The mandatory field DSGVO should be set to “Accepted” and not “empty” and also the registration date is empty!
Also the user data are clearly not real!Plugin Version Version: 2.1.12
WordPress 5.5.3
-
It’s in german version i hope its clear anyway.
During a normal user registration, as far as I have tested it, you cannot create a new user without confirming this field!
So a bot or spammer must have managed to bypass this process somehow!
I saw that there is an option for the DSGVO in your form, I will try to use this function instead of the checkbox field. Let’s see if that helps, but it should work with the checkbox field too!
Recaptcha is the next thing I wanted to try, but again:
It is obvious that someone is using the form in a different way to create users. A normal user registration looks different and can’t bypass mandatory fields! So I believe that even a Recaptcha will not change this!
The topic ‘Security Issue User Registration (Version 2.1.12)’ is closed to new replies.
