Profile Builder < 3.10.8 - Contributor+ User Metadata Disclosure

2024-01-0500:00:00

wpscan.com

profile builder

unauthorized access

data disclosure

capability check

user metadata

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function allowing authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.