CVE

CVE-2021-24527

9.8

CVSS

Description

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.

Attack Vector

Privileges Req.

User Interaction

user registration & user profile – profile builder

Updated Sep 26, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2021-24527 Scanner

CVE-2021-24527 Scanner - Improper Authentication vulnerability in Profile Builder

Used 2.1k times · 3.3k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: user registration & user profile – profile builder

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →