Description
The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Profile Builder | < 3.9.8 | 3.9.8 |
References
- https://wpscan.com/vulnerability/fc719d12-2f58-4d1f-b696-0f937e706842 exploit vdb-entry technical-description