WordPress Profile Builder Plugin 'key' Parameter Security Bypass Vulnerability
BID:53667
Info
WordPress Profile Builder Plugin 'key' Parameter Security Bypass Vulnerability
| Bugtraq ID: | 53667 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 23 2012 12:00AM |
| Updated: | May 23 2012 12:00AM |
| Credit: | Charlie Eriksen |
| Vulnerable: |
WordPress Profile Builder Plugin 1.1.24 |
| Not Vulnerable: |
WordPress Profile Builder Plugin 1.1.26 |
Discussion
WordPress Profile Builder Plugin 'key' Parameter Security Bypass Vulnerability
Profile Builder Plugin for Wordpress is prone to a security-bypass vulnerability.
Successfully exploiting this issue may allow an attacker to gain unauthorized access to user accounts.
Profile Builder 1.1.24 is vulnerable; other versions may also be affected.
Profile Builder Plugin for Wordpress is prone to a security-bypass vulnerability.
Successfully exploiting this issue may allow an attacker to gain unauthorized access to user accounts.
Profile Builder 1.1.24 is vulnerable; other versions may also be affected.
Exploit / POC
WordPress Profile Builder Plugin 'key' Parameter Security Bypass Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
Solution / Fix
WordPress Profile Builder Plugin 'key' Parameter Security Bypass Vulnerability
Solution:
Vendor updates are available. Please see the references for details.
Solution:
Vendor updates are available. Please see the references for details.
References
WordPress Profile Builder Plugin 'key' Parameter Security Bypass Vulnerability
References:
References:
- Changeset 547448 for profile-builder/trunk/front-end/wppb.recover.password.php (WordPress)
- Profile Builder Changelog (WordPress)
- Profile Builder Homepage (WordPress)