CVE-2024-31341: 
WordPress vulnerability analysis and mitigation

The WordPress User Profile Builder plugin contains a vulnerability (CVE-2024-31341) that affects versions up to and including 3.11.2. This security issue involves insufficient verification of data authenticity that allows functionality bypass, specifically enabling unauthenticated attackers to bypass restricted email domain restrictions during user registration (Patchstack, WPScan).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. It is classified as a CWE-345 (Insufficient Verification of Data Authenticity) issue and falls under the OWASP Top 10 category A5: Security Misconfiguration (Patchstack).

The vulnerability allows unauthenticated attackers to register user accounts with email addresses that should be restricted by the plugin's email domain restrictions, effectively bypassing the intended security controls (WPScan).

The vulnerability can be exploited by unauthenticated attackers and requires low attack complexity. No user interaction is needed for exploitation (Patchstack).

Users are advised to update to version 3.11.3 or later of the Profile Builder plugin to remediate this vulnerability. The issue has been fixed in version 3.11.3 (Patchstack).