Medium severity · published Feb 14, 2023
CVE-2023-0814
Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode
6.5
CVSS
0.8%
EPSS
No
On KEV
Description
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UP
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · cozmoslabs
through 3.9.0 · source: vendor
PB
Profile Builder · Cozmoslabs
through 3.9.0 · source: NVD
Affected product
UP
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
cozmoslabs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0814
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0814
lana.codes
https://lana.codes/lanavdb/512e7307-04a5-4d8b-8f79-f75f37784a9f/
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2864329%40profile-builder&new=2864329%40profile-builder&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/blog/2023/03/vulnerability-patched-in-cozmolabs-profile-builder-plugin-information-disclosure-leads-to-account-takeover/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/bbedad66-a5a6-4fb5-b03e-0ecf9fbef19a?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/bbedad66-a5a6-4fb5-b03e-0ecf9fbef19a
More from User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
9.8
CVE-2026-15826
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
8.8
CVE-2023-47669
WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF)
8.1
CVE-2026-109447
User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
8.1
CVE-2023-2297
Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism
7.5
CVE-2024-0324
User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update