Profile Builder CVE-2024-6695: Unauthenticated Privilege Escalation to Admin (CVSS 9.8)

If your WordPress site lets visitors register their own accounts, the plugin that powers those registration and profile forms sits right on the front line of your security. Profile Builder is one of the most widely used tools for that job, running on more than 50,000 active sites. In July 2024, security researchers disclosed a critical flaw in it, tracked as CVE-2024-6695, that allowed a complete stranger with no account and no credentials to register their way into an administrator account. This post explains what went wrong, how the attack worked, and exactly what you need to do to stay safe.

CVE Details

• CVE ID: CVE-2024-6695
• Plugin: Profile Builder and Profile Builder Pro (by Cozmoslabs)
• Active installations: 50,000+
• Vulnerability type: Unauthenticated Privilege Escalation
• CVSS 3.1 score: 9.8 (Critical) — vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Affected versions: All versions up to and including 3.11.8
• Patched version: 3.11.9 (released July 11, 2024)
• Discovered by: John Castro (WPScan)

A CVSS score of 9.8 is about as serious as a web vulnerability gets. The “unauthenticated” label is what makes it especially dangerous: an attacker does not need to already have an account, guess a password, or trick a logged-in user into clicking anything. They can carry out the attack entirely on their own, against any site running a vulnerable version with registration enabled.

How the vulnerability works

The flaw comes down to a subtle but costly inconsistency in how the plugin treated the email address a person submitted during registration. Understanding it doesn’t require you to be a developer — the core idea is that two parts of the same feature disagreed about which user they were talking about.

Profile Builder includes a convenience feature that automatically logs a new user in as soon as they finish registering. Normally that’s harmless: you sign up, the plugin creates a fresh subscriber account for you, and it logs you into that brand-new low-privilege account. The problem lived in the gap between the checks that validate a registration and the code that decides which account to log the visitor into.

During validation, the plugin checked whether the submitted email already belonged to an existing user and, on the standard registration form, would reject duplicates with a “this email is already in use” message. But the automatic login step did something different. It took the email value from the submitted form, looked up the WordPress user account that matched that email, generated a login token (a “nonce”) for that account’s user ID, and then used it to log the visitor straight in.

Because the two stages handled the email field inconsistently — differing in how values were trimmed, sanitized, and matched — an attacker could craft a registration request whose email slipped past the duplicate check while still resolving, at the login stage, to an existing account. If that existing account happened to be the site administrator’s, the plugin would happily generate a valid session and log the attacker in as the admin. No password required. The very feature meant to smooth out onboarding became a door into the most powerful account on the site.

To pull this off, an attacker essentially needs two things: a site running a vulnerable version of Profile Builder, and front-end registration enabled (which is the entire reason most people install the plugin). Knowing or guessing the administrator’s email address — often trivially discoverable — is the final piece.

Real-world impact

Administrator access on a WordPress site is the keys to the entire kingdom. Once an attacker holds an admin session, essentially nothing on the site is off limits. In practical terms, a successful exploit of CVE-2024-6695 could let an attacker:

• Install malicious plugins or themes to establish a persistent backdoor that survives even after the original hole is patched.
• Create additional hidden administrator accounts so they can return at will.
• Inject spam, SEO spam, or malicious redirects that send your visitors to scam or malware sites.
• Steal customer data, user records, and any personal information stored in the database.
• Deface the site, delete content, or take it offline entirely.
• Use your server as a launchpad for attacks on other sites, damaging your domain’s reputation and email deliverability.

Because the attack is unauthenticated and easy to automate, vulnerabilities like this are frequently swept up by bots that scan the entire internet looking for exposed sites. That means the risk is not limited to high-profile targets — any site running the vulnerable plugin is a candidate.

How to check if you’re affected

You are potentially affected if your site runs Profile Builder or Profile Builder Pro at version 3.11.8 or earlier. Here’s how to confirm:

1. Log in to your WordPress dashboard and go to Plugins > Installed Plugins.
2. Look for “Profile Builder” or “Profile Builder Pro” in the list.
3. Check the version number shown beneath the plugin name. If it is 3.11.8 or lower, your site is vulnerable and needs to be updated immediately.
4. Consider whether front-end user registration is enabled on your site. If it is, the exposure is greater — but you should update regardless.

If you manage many sites, you can also check versions in bulk from a management dashboard, or use a vulnerability scanner to flag any installs still running the affected releases.

How to fix it

The fix is straightforward: update Profile Builder to version 3.11.9 or later. The developers, Cozmoslabs, released the patch on July 11, 2024, and it corrects the inconsistency by handling the user-provided email consistently across every stage of registration and adding tighter security checks before any automatic login occurs.

1. In your dashboard, go to Dashboard > Updates or Plugins > Installed Plugins.
2. If an update for Profile Builder is available, click Update Now. Confirm afterward that the installed version is 3.11.9 or higher.
3. If you use Profile Builder Pro, download the latest release from your Cozmoslabs account and update accordingly.

Beyond the immediate patch, a few hardening steps reduce your exposure to this class of vulnerability in the future:

• Turn on automatic updates for plugins where you can, so critical security releases land without waiting on a manual review.
• Disable user registration if your site doesn’t actually need it (Settings > General, uncheck “Anyone can register”).
• Use a unique, hard-to-guess email address for administrator accounts rather than a public-facing one, and don’t reuse it as a display name.
• Deploy a web application firewall (WAF) that can virtually patch known vulnerabilities and block exploit attempts before they reach your site.
• If you suspect compromise, review your list of administrator accounts for anything unfamiliar, audit recently installed plugins and themes, rotate all passwords, and consider a full malware scan.

Takeaway

CVE-2024-6695 is a textbook reminder that the most dangerous vulnerabilities often hide in convenience features — in this case, an auto-login helper that trusted the wrong email at the wrong moment. The good news is that the defense is simple, and it’s the same defense that protects you against the overwhelming majority of WordPress attacks: keep your plugins updated, run only the features you genuinely need, and put a firewall between your site and the internet’s constant background hum of automated attacks. If you’re running Profile Builder, take a minute today to confirm you’re on 3.11.9 or later. It’s the cheapest insurance you’ll buy all week.