CVE-2024-6695
profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.11.8. This is due to the plugin not properly handling the user registration flow and utilizing different functionality at different stages of the process. This makes it possible for unauthenticated attackers to login as other users granted they know the user's email address. Successful exploitation requires the user registration and the 'Automatically Log In' features (disabled by default) to be enabled.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-07-10 CVE Published
- 2024-07-11 CVE Reserved
- 2024-07-31 CVE Updated
- 2024-07-31 EPSS Updated
- 2024-07-31 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-288: Authentication Bypass Using an Alternate Path or Channel
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://wpscan.com/vulnerability/4afa5c85-ce27-4ca7-bba2-61fb39c53a5b | 2024-07-31 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Unknown Search vendor "Unknown" | User Profile Builder Search vendor "Unknown" for product "User Profile Builder" | < 3.11.9 Search vendor "Unknown" for product "User Profile Builder" and version " < 3.11.9" | en |
Affected
| ||||||