CVE-2024-0324 is a high severity (CVSS 8.2) missing authorization weakness in User Profile Builder Plugin. Update the plugin to a release newer than 3.10.8 and check its changelog. It is not listed as exploited in the wild by CISA. Check your own installs against the affected range below.
What's affected
The User Profile Builder plugin for WordPress, from Cozmos Labs, in all versions up to and including 3.10.8. The function wppb_two_factor_authentication_settings_update has no capability check, so unauthenticated attackers can enable or disable the two-factor authentication feature of the Premium version for arbitrary user roles.
The weakness is mapped to CWE-284, improper access control, and CWE-862, missing authorization. The record was published on 2024-02-05. The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog.
The plugin is published on WordPress.org as User Profile Builder, Beautiful User Registration Forms, User Profiles and User Role Editor. The issue concerns the two-factor authentication feature that ships in the Premium version of the plugin.
How to check if you're exposed
List the plugin and its version from the WordPress command line.
wp plugin list --name=profile-builder --fields=name,version,status
If the plugin is active and the version is 3.10.8 or lower, the site is affected. Also open the two-factor authentication settings and confirm they match what you set.
You can also paste a manifest or SBOM into the free in-browser scanner at Safeguard Gold to see which known CVEs apply to your dependencies. It only covers components that appear in a manifest or SBOM, so a standalone appliance still needs the manual check.
What to do now
- Find every deployment of User Profile Builder Plugin in your environment, including test systems and anything bought or installed by a team outside IT.
- Update the User Profile Builder plugin to the newest release and read the changelog to confirm the version that fixes this issue.
- Review which user roles currently have two-factor authentication enabled and confirm that the settings are what you configured.
- Check the site for unexpected changes to user roles or new administrator accounts.
- Consider restricting access to admin AJAX endpoints at the web server if you cannot update at once.
- Re-run a scan after the change and record the date, so you can show the exposure is closed.
Why it matters
A missing capability check means the code performs a privileged action without asking whether the caller is allowed to. In WordPress, plugins are expected to check the caller capability before changing settings, and to verify a nonce for requests that change state.
The impact here is on an authentication control. Being able to switch two-factor authentication on or off for chosen roles weakens the protection that site owners rely on for administrator accounts.
The CVSS vector reads as follows. The attack is possible over the network, attack complexity is low, privileges required are none, and user interaction is not needed. The impact on confidentiality, integrity and availability is no, high and limited respectively. A score is a starting point. Your own exposure, meaning whether the product faces the internet and what it can reach, decides the real priority.
Quick check
Is this vulnerability known to be exploited in the wild?
The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog. Check the vendor advisory for current status.
Which versions are fixed?
Update the plugin to a release newer than 3.10.8 and check its changelog.
Sources
The vendor and researcher references listed in the NVD record could not be retrieved when this post was written, so the details above come from the NVD record itself.
Last reviewed: 19 October 2026.
