CVE-2024-6695

profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation

it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.

Affected

User Profile Builder

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.80% chance of exploitation in the next 30 days, 56th percentile

Published

2024-07-31

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/4afa5c85-ce27-4ca7-bba2-61fb39c53a5b/

Security advisories

• https://wpscan.com/vulnerability/4afa5c85-ce27-4ca7-bba2-61fb39c53a5b

References

• CVE Record
• NVD entry