Profile Builder <= 3.1.0 - Privilege Escalation
2020-02-13 00:00
Mikey VeenstraStrategic Overview
StatusPatched in 3.1.1
Affected PluginProfile Builder Pro
Affected Version
< 3.1.1CVSS9.8Critical
CVE
N/AVulnerability Overview
The Profile Builder and Profile Builder Pro plugin versions up to and including 3.1.0 allows unauthenticated attackers to gain administrator-level permissions by registering users on a vulnerable site and assigning their own role.
Technical Analysis
REMEDIATION: Update to version 3.1.1, or a newer patched version --- IDENTIFIER: CWE-269 (Improper Privilege Management) The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C