| शीर्षक | Cozmoslabs Profile Builder – User Profile & User Registration Forms 3.16.1 and earlier Unauthenticated File Upload |
|---|
| विवरण | Profile Builder for WordPress version 3.16.1 and earlier contains an unauthenticated file upload vulnerability in the Avatar Simple Upload AJAX handler. When a public registration form contains an Avatar field with Simple Upload enabled, an unauthenticated attacker can obtain a publicly exposed WordPress nonce and submit files directly to the wppb_ajax_simple_avatar action through /wp-admin/admin-ajax.php. The vulnerable handler does not apply the server-side extension and per-field file-size validation enforced by the normal registration workflow. As a result, an attacker can create persistent, orphaned WordPress Media Library attachments without authenticating or completing registration, bypassing the upload restrictions configured by the administrator. Uploaded files are typically publicly accessible under the WordPress uploads directory. WordPress global MIME restrictions still apply on default installations, and arbitrary PHP code execution was not demonstrated. The issue was fixed in Profile Builder version 3.16.2. |
|---|
| स्रोत | ⚠️ https://ciphersecuritylabs.com/research/articles/when-the-browser-is-the-only-bouncer-unauthenticated-media-upload-in-profile-builder |
|---|
| उपयोगकर्ता | ciphersecuritylabs (UID 99852) |
|---|
| सबमिशन | 16/07/2026 11:17 AM (2 महीनों पहले) |
|---|
| संयम | 30/08/2026 09:21 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397108 [Cozmoslabs Profile Builder Plugin तक 3.16.1 पर WordPress Avatar Simple Upload AJAX /wp-admin/admin-ajax.php wppb_ajax_simple_avatar अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|