User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, c66ca449-600d-46ba-bb27-1ab5699dd4a4
- CVE, Research URL
- Home page URL
- Application
-
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Published on
- -
- Research Description
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.3.3 Profile Builder & Profile Builder Pro < 3.3.3 - Authenticated Blind SQL Injection The orderby parameter of the wp-admin/users.php?page=unconfirmed_emails&orderby=email&order=asc page, which is available when the "Email confirmation" setting of the plugin is activated (default is off), is not properly sanitised and validated before being concatenated in a SQL statement, leading to an SQL injection. The issue is exploitable by high privilege users such as administrators.
- Affected versions
-
max 3.3.3.
- Status
-
vulnerable