CVE-2024-0324

HIGH

User Profile Builder < 3.10.8 - Unauthenticated Two-Factor Authentication Settings Modification

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-0324. PoCs published by kodaichodai.

AI-analyzed exploit summary This exploit sends a crafted HTTP POST request to a WordPress admin endpoint to manipulate two-factor authentication settings, likely bypassing authentication. The payload targets a specific option page and role configuration.

Description

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppb_two_factor_authentication_settings_update' function in all versions up to, and including, 3.10.8. This makes it possible for unauthenticated attackers to enable or disable the 2FA functionality present in the Premium version of the plugin for arbitrary user roles.

Exploits (1)

nomisec WORKING POC
by kodaichodai · poc
https://github.com/kodaichodai/CVE-2024-0324

This exploit sends a crafted HTTP POST request to a WordPress admin endpoint to manipulate two-factor authentication settings, likely bypassing authentication. The payload targets a specific option page and role configuration.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: WordPress (specific plugin not explicitly named, but likely a plugin handling two-factor authentication)
No auth needed
Prerequisites: Target must have the vulnerable WordPress plugin installed · Target endpoint must be accessible
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 8.2
EPSS 0.0243
EPSS Percentile 82.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-284 CWE-862
Status published
Products (2)
cozmoslabs/profile_builder < 3.10.8
cozmoslabs/User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.10.8
Published Feb 05, 2024
Tracked Since Feb 18, 2026