What the vulnerability does
01Description
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
User Profile Builder versions 3.9.0 and earlier contain a vulnerability allowing unauthenticated attackers to run their own code on affected sites. No user interaction or special configuration is required. The vulnerability affects all installations of the plugin and can lead to complete compromise of the site, including unauthorized access to data and modification of content.
What an attacker can do
03Attacker Capabilities
Run arbitrary code on the site without authentication, gaining full control over the WordPress installation.
Potential impact on your site
04Site Impact
Complete site compromise: attackers can steal data, modify content, create admin accounts, or inject malware.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 26, 2023
CVE published
April 8, 2026
Record updated
