What’s Vulnerable › Vulnerabilities
CVE-2024-6695: profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-07-31 · updated 2026-06-17
- Weakness: CWE-863
Description
it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
Affected products
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: before 3.11.9 — fixed in 3.11.9
How to fix
Upgrade to a fixed version: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor 3.11.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-6695 or the next vulnerability affects your stack