PT-2023-16543 · WordPress · The Profile Builder – User Profile & User Registration Forms
István Márton
+1
·
Publicado
2023-02-14
·
Atualizado
2023-04-27
·
CVE-2023-0814
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
The Profile Builder – User Profile & User Registration Forms plugin for WordPress versions up to, and including 3.9.0
Description
The issue is related to sensitive information disclosure via the
user meta shortcode. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. Authenticated attackers with subscriber-level permissions and above can retrieve sensitive user meta, potentially gaining access to a high-privileged user account. The Usermeta shortcode must be enabled for this issue to be exploited.Recommendations
For versions up to, and including 3.9.0, consider disabling the
user meta shortcode until a patch is available to prevent exploitation. Restrict access to sensitive user meta values to minimize the risk of unauthorized access.Correção
Information Disclosure
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
The Profile Builder – User Profile & User Registration Forms