CVE-2021-24527

Profile Builder < 3.4.9 - Admin Access via Password Reset

State: Published
Severity: Not scored
Published: Aug 16, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.

Scores

The record has no CVSS score.

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
User Registration & User Profile – Profile BuilderUnknown	3.4.9 to before 3.4.9Affected

References

https://wpscan.com/vulnerability/c142e738-bc4b-4058-a03e-1be6fca47207

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.