PT-2026-5609 · WordPress · User Profile Builder
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
User Profile Builder WordPress plugin versions prior to 3.15.2
Description
The User Profile Builder WordPress plugin does not have a secure password reset process. This allows unauthenticated requests to reset the password for any user, including administrators, by knowing their username. Successful exploitation grants access to user accounts.
Recommendations
Update to User Profile Builder WordPress plugin version 3.15.2 or later.
Exploit
Correção
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
User Profile Builder