CVSS 3.1 Score 7.5 of 10 (high)


Published Feb 5, 2024
Updated: Feb 13, 2024
CWE ID 862


CVE-2024-0324 is a vulnerability found in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress. This vulnerability affects all versions up to and including 3.10.8 of the plugin. It is a missing capability check on the 'wppb_two_factor_authentication_settings_update' function that allows unauthenticated attackers to modify data and enable or disable the 2FA functionality for arbitrary user roles. The vulnerability has a high severity rating with a base score of 7.5 and an exploitability score of 3.9 according to [email protected]. The potential danger it poses is primarily to organizations using this plugin, as it can lead to unauthorized access and manipulation of user data. Remediation measures would involve updating the plugin to a version that includes the necessary capability check or finding an alternative solution altogether.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-0324 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options