Peprodev Ultimate Profile Solutions
Approved changes feed: RSS · Atom
cpe:2.3:a:peprodev:peprodev_ultimate_profile_solutions:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Peprodev (2f1d3423-2e88-55ca-9a95-7c51619a29ef) |
|---|---|
| Product | Peprodev Ultimate Profile Solutions (998ea10e-41ef-5100-89a3-b719b8da294f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-3924 |
vulnerable | 2026-06-08 07:23:10.151552 |
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration
MEDIUM (5.3)
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via its publicly exposed reset-password endpoint. The plugin looks up the 'valid_email' value based solely on a supplied username parameter, without verifying that the requester is associated with that user account. This allows unauthenticated attackers to enumerate email addresses for any user, including administrators.
Published: 2025-05-07T01:43:07.782Z
Updated: 2025-05-07T14:03:17.735Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3921 |
vulnerable | 2026-06-08 07:23:10.146817 |
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function
HIGH (8.2)
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel_ajax_req() function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata which can be leveraged to block an administrator from accessing their site when wp_capabilities is set to 0.
Published: 2025-05-07T01:43:08.850Z
Updated: 2025-05-07T14:03:00.745Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3844 |
vulnerable | 2026-06-08 07:23:10.015463 |
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover
CRITICAL (9.8)
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Authentication Bypass in versions 1.9.1 to 7.5.2. This is due to handel_ajax_req() function not having proper restrictions on the change_user_meta functionality that makes it possible to set a OTP code and subsequently log in with that OTP code. This makes it possible for unauthenticated attackers to login as other users on the site, including administrators.
Published: 2025-05-07T01:43:07.411Z
Updated: 2025-05-07T14:03:23.728Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.