CVE-2023-2297 - Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism

Back Back to CVE browser

CRITICAL

Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism

Published Apr 26, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.99%

Description

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.

Affected products

Vendor Cozmoslabs Product n/a Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=3.9.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cozmoslabs

n/a

unaffected

Version	Status	Constraints
0	affected	<=3.9.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-620

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33803
Advisory
https://lana.codes/lanavdb/512e7307-04a5-4d8b-8f79-f75f37784a9f/
ExploitThird Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2864329%40profile-builder&new=2864329%40profile-builder&sfp_email=&sfph_mail=
Patch
https://www.wordfence.com/blog/2023/03/vulnerability-patched-in-cozmolabs-profile-builder-plugin-information-disclosure-leads-to-account-takeover/
ExploitThird Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/e731292a-4f95-46eb-889e-b00d58f3444e?source=cve
PatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33803		Advisory
https://lana.codes/lanavdb/512e7307-04a5-4d8b-8f79-f75f37784a9f/		ExploitThird Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2864329%40profile-builder&new=2864329%40profile-builder&sfp_email=&sfph_mail=		Patch
https://www.wordfence.com/blog/2023/03/vulnerability-patched-in-cozmolabs-profile-builder-plugin-information-disclosure-leads-to-account-takeover/		ExploitThird Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/e731292a-4f95-46eb-889e-b00d58f3444e?source=cve		PatchThird Party Advisory