http/vulnerabilities/wordpress/wp-enabled-registration.yaml

id: wp-enabled-registration

info:
  name: WordPress user registration enabled
  author: Ratnadip Gajbhiye,ritikchaddha
  severity: info
  metadata:
    max-request: 1
  tags: wordpress

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-login.php?action=register'
      - '{{BaseURL}}/wp-signup.php'

    host-redirects: true
    max-redirects: 4
    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "Register For This", "register_form_message", "registerform", "signup-form", "signup_form", "login-action-register","-register")'
          - 'contains_any(body, "/wp-includes", "/wp-content")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100f9ddeb2cbd5ccb0aa27ab4eab3dee915ef5231aeb68d9a3795619a5d43672c7d022100ae0d9a459aa044232f1b490aba3be59ab0b29e7992006a12c36f0b38c113bf44:922c64590222798bb761d5b6d8e72950
updating template 2021-01-21 20:17:20 +05:30			`id: wp-enabled-registration`
Create WordPress-user-registration-enabled.yaml Description : Your WordPress site is currently configured so that anyone can register as a user. If you are not using this functionality, it's recommended to disable user registration as it caused some security issues in the past and is increasing the attack surface. 2021-01-20 15:52:55 +05:30
			`info:`
			`name: WordPress user registration enabled`
Update wp-enabled-registration.yaml 2024-12-08 10:08:10 +05:30			`author: Ratnadip Gajbhiye,ritikchaddha`
updating template 2021-01-21 20:17:20 +05:30			`severity: info`
Added max request counter of each template 2023-04-28 13:41:21 +05:30			`metadata:`
Revert "chore: update TemplateMan 🤖" This reverts commit c31d574176f2b9e6f8d4fe573a24e7192f808e84. 2025-05-27 10:39:47 +08:00			`max-request: 1`
templateman update 2023-10-14 16:57:55 +05:30			`tags: wordpress`
Create WordPress-user-registration-enabled.yaml Description : Your WordPress site is currently configured so that anyone can register as a user. If you are not using this functionality, it's recommended to disable user registration as it caused some security issues in the past and is increasing the attack surface. 2021-01-20 15:52:55 +05:30
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 09:58:59 +05:30			`http:`
Create WordPress-user-registration-enabled.yaml Description : Your WordPress site is currently configured so that anyone can register as a user. If you are not using this functionality, it's recommended to disable user registration as it caused some security issues in the past and is increasing the attack surface. 2021-01-20 15:52:55 +05:30			`- method: GET`
			`path:`
			`- '{{BaseURL}}/wp-login.php?action=register'`
Fix FN wp-enabled-registration.yaml 2024-12-05 23:24:53 +05:30			`- '{{BaseURL}}/wp-signup.php'`
updating template 2021-01-21 20:17:20 +05:30
Fix FN wp-enabled-registration.yaml 2024-12-05 23:24:53 +05:30			`host-redirects: true`
Update wp-enabled-registration.yaml 2024-12-08 10:08:10 +05:30			`max-redirects: 4`
Create WordPress-user-registration-enabled.yaml Description : Your WordPress site is currently configured so that anyone can register as a user. If you are not using this functionality, it's recommended to disable user registration as it caused some security issues in the past and is increasing the attack surface. 2021-01-20 15:52:55 +05:30			`matchers:`
Fix FN wp-enabled-registration.yaml 2024-12-05 23:24:53 +05:30			`- type: dsl`
			`dsl:`
Update wp-enabled-registration.yaml 2024-12-08 10:08:10 +05:30			`- 'contains_any(body, "Register For This", "register_form_message", "registerform", "signup-form", "signup_form", "login-action-register","-register")'`
			`- 'contains_any(body, "/wp-includes", "/wp-content")'`
Fix FN wp-enabled-registration.yaml 2024-12-05 23:24:53 +05:30			`- 'status_code == 200'`
fixing typos 2021-03-10 19:33:49 +05:30			`condition: and`
chore: sign templates 🤖 2024-12-09 07:26:12 +00:00			`# digest: 4b0a00483046022100f9ddeb2cbd5ccb0aa27ab4eab3dee915ef5231aeb68d9a3795619a5d43672c7d022100ae0d9a459aa044232f1b490aba3be59ab0b29e7992006a12c36f0b38c113bf44:922c64590222798bb761d5b6d8e72950`