WordPress Plugin Vulnerabilities
Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation
Description
The plugin lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog
Proof of Concept
1. Access the URL: https://example.com/wp-admin/admin-post.php?page=profile-builder-basic-info&wppb_create_pages=true&wppb_force_create_pages=true 2. As a logged in user, see that the pages `/register`, `/log-in`, and `/edit-profile` have been created.
Affects Plugins
Fixed in 3.9.8 References
CVE
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Mesh3l_911
Submitter
Mesh3l_911
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-08-09 (about 9 months ago)
Added
2023-08-09 (about 9 months ago)
Last Updated
2023-08-09 (about 9 months ago)
WPScan 