CVE-2023-0814: Infoleak
First published: Tue Feb 14 2023(Updated: )
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cozmoslabs Profile Builder | <=3.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the Profile Builder plugin for WordPress?
The vulnerability ID for the Profile Builder plugin for WordPress is CVE-2023-0814.
What is the severity of CVE-2023-0814?
The severity of CVE-2023-0814 is medium.
How does CVE-2023-0814 affect the Profile Builder plugin for WordPress?
CVE-2023-0814 affects the Profile Builder plugin for WordPress by allowing sensitive information disclosure through the [user_meta] shortcode.
What is the affected software version for CVE-2023-0814?
The affected software version for CVE-2023-0814 is up to, and including 3.9.0.
Is there a fix available for CVE-2023-0814?
Yes, there is a fix available for CVE-2023-0814. Users should update to the latest version of the Profile Builder plugin for WordPress.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- agent/weakness
- agent/author
- agent/severity
- agent/first-publish-date
- agent/tags
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/cozmoslabs
- canonical/cozmoslabs profile builder
- version/cozmoslabs profile builder/3.9.0