CVE-2021-20282: 
PHP vulnerability analysis and mitigation

CVE-2021-20282 is a security vulnerability discovered in Moodle, a Course Management System, affecting versions before 3.10.2, 3.9.5, 3.8.8, and 3.5.17. The vulnerability allowed attackers to bypass email verification during user account creation by circumventing the verification email link/secret requirement (Moodle Advisory).

The vulnerability is classified with a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited remotely without requiring privileges or user interaction, and has a low impact on integrity (NVD).

The vulnerability allows attackers to verify user accounts without having access to the verification email link or secret that should be required during the account registration process. This bypasses an important security control designed to verify the authenticity of user email addresses (Moodle Advisory).

The vulnerability has been fixed in Moodle versions 3.10.2, 3.9.5, 3.8.8, and 3.5.17. Organizations running affected versions should upgrade to the patched versions to mitigate this security risk (Moodle Advisory).