Profile Builder and Profile Builder Pro < 3.1.1 - User Registration With Administrator Role



Description
The plugin is affected by a broken authentication vulnerability, allowing unauthenticated users to register or edit their account and gain the Administrator role using the plugin's forms.

The vulnerability only exists in the Plugin's own generated Registration Form or Profile Edit Form. This means if the blog is using shortcode [wppb-register] or [wppb-edit-profile] then it is vulnerable. This is very obvious shortcode which holds the basic functionality of the plugin so admin must be using it 90% of time if installed. If blog isn't using [wppb-register] but using [wppb-edit-profile] then vulnerability is still valid if Registration is enabled. CVSS Score of the vulnerability is 9.
Proof of Concept The PoC will be displayed on February 24, 2020, to give users the time to update.

Affects Plugins

fixed in version 3.1.1

References

URL https://www.wordfence.com/blog/2020/02/critical-vulnerability-in-profile-builder-plugin-allowed-site-takeover/

Classification

Type BYPASS

Miscellaneous

Original Researcher Noman Riffat
Submitter Noman Riffat
Submitter Twitter nomanriffat
Views 4151
Verified Yes
WPVDB ID 10066

Timeline

Publicly Published 2020-02-10 (11 days ago)
Added 2020-02-10 (10 days ago)
Last Updated 2020-02-15 (5 days ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin