Vulnerability · Published Sep 4, 2023 · Assigned by WPScan
CVE-2023-4059Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation
Medium 4.3
In plain English
A medium-severity security flaw in Profile Builder from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 85.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Profile Builder | 0 – before 3.9.8 |
References
- https://wpscan.com/vulnerability/fc719d12-2f58-4d1f-b696-0f937e706842 exploit, vdb-entry, technical-description