Unauthorized Password Reset in Profile Builder Plugin for WordPress

CVE-2023-2297

Summary

The Profile Builder – User Profile & User Registration Forms plugin for WordPress suffers from a vulnerability that allows unauthorized users to reset passwords due to insufficient validation in the password reset functionality. The issue arises from the use of an unencrypted password reset key, which can be easily exploited. Attackers may leverage this flaw in conjunction with other vulnerabilities, such as SQL injection in related plugins or themes, to gain access to user accounts without authorization. It is crucial for site administrators to update to the patched version to safeguard against potential account takeovers.

References