CVE-2024-6069: 
WordPress vulnerability analysis and mitigation

The Registration Forms plugin for WordPress (also known as User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction) contains a vulnerability (CVE-2024-6069) that affects all versions up to and including 3.8.3.4. The vulnerability allows unauthorized arbitrary plugin installation and activation/deactivation due to missing capability checks in several core functions (NVD).

The vulnerability stems from missing capability checks in three key functions: pieregisterinstalladdon, pieregisteractivateaddon, and pieregisterdeactivateaddon. This security flaw has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact potential (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to install, activate, and deactivate arbitrary plugins on the affected WordPress installation. This capability could potentially lead to code execution on the targeted server, giving attackers significant control over the compromised system (NVD).