Plugin Name: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Software Type: Plugin
- Software Slug: profile-builder
- Software Status: Active
- Software Author: reflectionmedia
- Software Downloads: 4,108,981
- Active Installs: 50,000
- Last Updated: January 5, 2024
- Patched Versions: 3.10.8
- Affected Versions: <= 3.10.6
- Name: Profile Builder <= 3.10.7
- Title: Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode
- Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVE: CVE-2023-6504
- CVSS Score: 4.3
- Publicly Published: January 5, 2024
- Researcher: Francesco Carlucci
- Description: The User Profile Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.
The User Profile Builder plugin for WordPress has a vulnerability in versions up to and including 3.10.7 that allows authenticated attackers with contributor-level access and above to perform Insecure Direct Object Reference and expose sensitive information within user metadata. This vulnerability has been patched in version 3.10.8.
The vulnerability stems from a missing capability check on the wppb_toolbox_usermeta_handler function, enabling authenticated attackers with contributor-level access and above to access user metadata without proper authorization. This poses a risk of exposing sensitive information. To address this vulnerability, users are strongly advised to update to version 3.10.8.
Advice for Users:
- Immediate Action: Update the User Profile Builder plugin to version 3.10.8 or later.
- Check for Signs of Vulnerability: Review user metadata for any unauthorized access or modifications.
- Alternate Plugins: Consider using alternative plugins with similar functionality as a precaution.
- Stay Updated: Regularly update your WordPress plugins to the latest versions to avoid vulnerabilities.
The swift response from the User Profile Builder developers to patch this vulnerability underscores the importance of timely updates. Users are advised to ensure that they are running version 3.10.8 or later to secure their WordPress installations.
- Wordfence Threat Intelligence - User Profile Builder Vulnerability
- Wordfence Threat Intelligence - WordPress Plugins Vulnerabilities
Simplifying Website Security for Busy Owners
As a busy website owner without ample time to stay on top of every threat, keeping your site secure can feel impossible. But vulnerabilities like the one recently patched in the popular User Profile Builder plugin only reinforce why vigilance matters. In this post I’ll simplify security for you by clearly explaining the vulnerability, your risk level, and actionable ways to lock down your website in minutes.
Understanding the User Profile Builder Vulnerability
User Profile Builder helps over 50,000 WordPress users customize registration forms, profiles, and user roles. This week a security researcher disclosed a vulnerability in versions up to 3.10.7 enabling some authenticated users to access private user metadata.
Specifically, the bug stems from a capability check missing in the wppb_toolbox_usermeta_handler function. Users with contributor access and above could exploit this to view signup details, contact info, or other data exceeding their roles. Depending on the fields exposed, this could lead to personal data theft.
The developers have now released version 3.10.8 to fully fix the vulnerability, scoring a moderate 4.3 CVSS severity rating due to limiting the user roles affected. Still, User Profile Builder users face unnecessary risk until updating.
Assessing Your Site’s Risk Level
While branded moderately severe, the vulnerability still poses unnecessary website risks from private data access. Depending on your registration fields, attackers could access names, emails, IP addresses, or other identifiable details to target individuals without permission to view profiles.
The good news is sites restricting contributor permissions likely face minimal real-world risk even before patching. But everyone should still update regardless since the metadata viewing vector exists pointlessly. Eliminating this unnecessary exposure keeps your site safer.
Updating to Eliminate the Vulnerability
If User Profile Builder is active on your WordPress site, you should:
- Immediately update to v3.10.8, which specifically repairs the missing capability check.
- Check user metadata for any unauthorized modifications.
- Consider temporarily hiding sensitive fields until assessing the risk.
- Restrict contributor permissions to only those viewing needs essential for your site’s functionality.
Staying Secure Long-Term
User Profile Builder has faced over 19 previous vulnerabilities since 2014, indicating systemic issues around access controls. From SQL injection to stored XSS and beyond, threats inevitably arise without diligent auditing and patching.
As tempting as neglecting security feels for overloaded owners, a well-hardened site takes little effort:
- Enable automatic background updates for plugins to remove the manual chore.
- Minimize plugins and themes to only reputable options essential for your needs.
- Leverage managed WordPress hosts handling technical tasks like updates for you.
Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.
Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.
Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.