CVE-2024-6366
📋 TL;DR
The User Profile Builder WordPress plugin before version 3.11.8 has an authorization vulnerability that allows unauthenticated users to upload media files via the async upload functionality. This affects all WordPress sites running vulnerable versions of the plugin, potentially enabling attackers to upload malicious files without authentication.
💻 Affected Systems
- User Profile Builder WordPress plugin
📦 What is this software?
Profile Builder by Cozmoslabs
⚠️ Risk & Real-World Impact
Worst Case
Attackers upload webshells or malware, gain remote code execution, and completely compromise the WordPress site and underlying server.
Likely Case
Attackers upload malicious files (PHP shells, malware) to gain unauthorized access, deface websites, or establish persistence for further attacks.
If Mitigated
With proper file type restrictions and server-side validation, impact is limited to unauthorized file storage without execution capabilities.
🎯 Exploit Status
Simple HTTP POST requests can exploit this vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.11.8
Vendor Advisory: https://wpscan.com/vulnerability/5b90cbdd-52cc-4e7b-bf39-bea0dd59e19e/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find User Profile Builder plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 3.11.8+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the User Profile Builder plugin until patched
wp plugin deactivate user-profile-builder
Restrict upload directory
linuxSet proper permissions on wp-content/uploads directory
chmod 755 wp-content/uploads
chown www-data:www-data wp-content/uploads
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block unauthorized upload requests
- Disable the async upload functionality via .htaccess or server configuration
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins → Installed PluginsCheck Version:
wp plugin get user-profile-builder --field=versionVerify Fix Applied:
Confirm plugin version is 3.11.8 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with upload parameters
- File uploads from unauthenticated IP addresses
Network Indicators:
- HTTP POST requests to async upload endpoints without authentication headers
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND action="upload" AND user="-"