CVE-2024-22141 WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data Exposure
An attacker can access sensitive information from the Profile Builder Pro plugin without authorization, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-22141?
CVE-2024-22141 is a medium-severity vulnerability in Cozmoslabs Profile Builder Pro, published on 24 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0.
Weakness: CWE-200
Which versions are affected by CVE-2024-22141?
It affects 1 product.
Products include Cozmoslabs Profile Builder.
How do I fix CVE-2024-22141?
No fix has been published for CVE-2024-22141 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-22141 being exploited?
There is no known exploitation of CVE-2024-22141 in the wild and no public exploit code.
Other vulnerabilities in Cozmoslabs Profile Builder Pro
- CVE-2024-6695 profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation
- CVE-2023-2297 Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism
- CVE-2021-24527 Profile Builder < 3.4.9 - Admin Access via Password Reset
- CVE-2024-6366 User Profile Builder < 3.11.8 - Unauthenticated Media Upload
- CVE-2024-22140 WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Request Forgery (CSRF)
Sources
Also known as GHSA-v27c-q5xg-jvvh.