by Kastro
Paper/Archive/CVE-2024-6366

CVE-2024-6366

Unknown User Profile Builder — User Profile Builder < 3.11.8 - Unauthenticated Media Upload

EPSS 29%public exploitCVSS 9.1
critical.is priorityof 100
57
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 98.2.982 × 2019.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.

Affected

ProductAffectedFixed inSource
User Profile Builder< 3.11.83.11.8CNA
profile_builder< 3.11.83.11.8CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/5b90cbdd-52cc-4e7b-bf39-bea0dd59e19e