User Profile Builder vulnerabilities

The User Profile Builder plugin for WordPress up to version 3.16.4 is vulnerable to authentication bypass via type confusion. The wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress rejects it with a WP_Error object, but absint() coerces that object to the integer 1, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This allows unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover.

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the plugin itself, so further impact requires a suitable gadget from another installed plugin.

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.

The User Profile Builder WordPress plugin before version 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.

The User Profile Builder plugin for WordPress up to version 3.15.5 is vulnerable to Insecure Direct Object Reference in the wppb_save_avatar_value() function due to missing validation on a user controlled key. Authenticated attackers with subscriber-level access and above can reassign ownership of arbitrary posts and attachments by changing 'post_author'.