CVE-2024-6366: User Profile Builder < 3.11.8 - Unauthenticated Media Upload
Published Jul 29, 2024
·Updated
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
Affected Software
2 affected components
Cozmoslabs Profile Builder Wordpress<3.11.8
User Profile Builder User Profile Builder<3.11.8
Event History
Jul 29, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-6366?
CVE-2024-6366 is classified as a medium severity vulnerability due to its potential to allow unauthorized file uploads.
2
How do I fix CVE-2024-6366?
To fix CVE-2024-6366, update the User Profile Builder plugin to version 3.11.8 or later.
3
Who is affected by CVE-2024-6366?
CVE-2024-6366 affects all versions of User Profile Builder prior to 3.11.8.
4
What can an attacker do with CVE-2024-6366?
An attacker can exploit CVE-2024-6366 to upload arbitrary media files without proper authorization.
5
Is there a workaround for CVE-2024-6366 until I can update?
A temporary workaround for CVE-2024-6366 is to disable the async upload functionality until the plugin is updated.