WordPress Plugin Vulnerabilities

Profile Builder < 1.1.60 - Password Recovery Bypass

Description

The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Password Recovery Bypass security vulnerability in the front-end/wppb.recover.password.php file.

Affects Plugins

Plugin icon
profile-builder
Fixed in 1.1.60

References

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
6.5 (medium)

Miscellaneous

Verified
No
WPVDB ID
4f4054e7-8350-499e-9418-7cf59784e357

Timeline

Publicly Published
2014-08-01 (about 11 years ago)
Added
2014-08-01 (about 11 years ago)
Last Updated
2020-11-26 (about 5 years ago)

Other

Published
Title
Published
2025-02-11
Title
Customer Email Verification for WooCommerce < 2.9.6 - Authentication Bypass via Shortcode
Published
2021-02-02
Title
MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple
Published
2025-06-26
Title
Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin
Published
2016-03-22
Title
OptinMonster <= 1.1.4.5 - Execution of Arbitrary Shortcodes
Published
2024-10-11
Title
Bot for Telegram on WooCommerce <= 1.2.7 - Subscriber+ Authentication Bypass