Vulnerability · Published Jul 31, 2024 · Assigned by WPScan
CVE-2024-6695profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation
Critical 9.8
In plain English
A critical-severity security flaw in User Profile Builder from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.8%top 43.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | User Profile Builder | 0 – before 3.11.9 |
References
- https://wpscan.com/vulnerability/4afa5c85-ce27-4ca7-bba2-61fb39c53a5b/ exploit, vdb-entry, technical-description