Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

ConvertPlus plugin can create unauthorized low‑privilege accounts

CVE-2019-15863 · published 7 years ago
Summary

The ConvertPlus add‑on for WordPress lets an attacker send a special request that creates a new user account with the lowest permission level. While the new account has limited rights, it can be a stepping stone for further attacks. Update the plugin to version 3.4.5 or later, or remove it if you do not need it, and review any newly created accounts.

What to do
  • Update convertplug convertplus to version 3.4.5 or later.
Affected software
VendorProductAffected versions
convertplug convertplus < 3.4.5
cpe:2.3:a:convertplug:convertplus:*:*:*:*:*:wordpress:*:*
Original advisory text
The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.
The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Timeline
Published3 Sep 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-15863 · NVD
Track software like this
Free during beta