User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, 4295aa5025a5e10f7789cad9b3c1259736aba758
- CVE, Research URL
- Home page URL
- Application
-
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Published on
- Dec 04, 2020
- Research Description
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.3.3 Profile Builder/Profile Builder Pro <= 3.3.2 - Authenticated Blind SQL Injection The Profile Builder/Profile Builder Pro plugins for WordPress is vulnerable to blind SQL Injection via multiple parameters in versions up to, and including, 3.3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 3.3.3.
- Status
-
vulnerable