CVE-2024-0324: 
WordPress vulnerability analysis and mitigation

The User Profile Builder WordPress plugin (versions up to 3.10.8) contains a vulnerability identified as CVE-2024-0324. This security flaw stems from a missing capability check in the 'wppb_two_factor_authentication_settings_update' function, which allows unauthenticated attackers to modify two-factor authentication (2FA) settings for arbitrary user roles (Wordfence Advisory).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 7.5 (High) according to NIST, and 8.2 (High) according to Wordfence. The security flaw exists in the Premium version's 2FA functionality, specifically within the 'wppb_two_factor_authentication_settings_update' function located in the admin-functions.php file (GitHub Source).

When exploited, this vulnerability allows unauthenticated attackers to enable or disable the two-factor authentication functionality for any user role in the system. This capability could potentially compromise the security measures intended to protect user accounts (Wordfence Advisory).

A patch has been released to address this vulnerability. Users should update their User Profile Builder plugin to a version newer than 3.10.8. The fix can be found in the WordPress plugin repository (WordPress Patch).