The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/c142e738-bc4b-4058-a03e-1be6fca47207 | Exploit Third Party Advisory |
Configurations
History
07 Nov 2023, 03:31
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example. |
23 Aug 2021, 17:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:cozmoslabs:profile_builder:*:*:*:*:*:wordpress:*:* | |
| References | (MISC) https://wpscan.com/vulnerability/c142e738-bc4b-4058-a03e-1be6fca47207 - Exploit, Third Party Advisory | |
| CWE | CWE-287 | |
| CVSS |
v2 : v3 : |
v2 : 10.0
v3 : 9.8 |
16 Aug 2021, 11:55
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-16 11:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-24527
Mitre link : CVE-2021-24527
CVE.ORG link : CVE-2021-24527
JSON object : View
Products Affected
cozmoslabs
- profile_builder
CWE
CWE-287
Improper Authentication