CVE-2023-4059

Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation

Medium · published September 4, 2023

CVSS v3.1
4.3
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00232 · 13.2th percentile
Published
2023-09-04T11:26Z
EPSS history
Timeline
  • 04 SEP 11:26Z
    Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation
    cvelistv5