Security readout for executives and security teams
Plain-English summary
A WordPress plugin could expose sensitive account metadata to any logged-in user when its Usermeta shortcode was enabled. For sites using Profile Builder 3.9.0 or older, a basic subscriber could retrieve data that may help compromise a privileged account. The issue is not anonymous, but public registration sites may have meaningful exposure.
Executive priority
Treat as a near-term remediation item for WordPress properties, especially public registration sites. It is medium severity, but the business impact can rise if exposed metadata enables administrator account compromise.
Technical view
CVE-2023-0814 is a CWE-200 information disclosure issue in the Profile Builder WordPress plugin. Versions up to and including 3.9.0 insufficiently restricted sensitive values returned through the [user_meta] shortcode. The CVSS 3.1 vector is network exploitable, low complexity, requires low privileges, and impacts confidentiality only.
Likely exposure
Exposure is most likely on WordPress sites running Profile Builder 3.9.0 or older with the Usermeta shortcode enabled and subscriber-level accounts available. Sites with public user registration or many low-privilege users face higher practical risk.
Exploitation context
The bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation requires an authenticated user with subscriber-level or higher permissions and the Usermeta shortcode enabled. Wordfence describes the impact as sensitive information disclosure that can support privileged account takeover.
Researcher notes
Evidence supports authenticated sensitive information disclosure through shortcode behavior, conditional on Usermeta shortcode enablement. The provided record does not include exploit telemetry, KEV status, or detailed affected configuration beyond the shortcode prerequisite. Avoid assuming anonymous exploitability.
Mitigation direction
- Upgrade Profile Builder to a version newer than 3.9.0 or follow vendor guidance.
- Disable the Usermeta shortcode if it is not required.
- Restrict or review public user registration on affected WordPress sites.
- Audit privileged user accounts for suspicious changes or access.
- Apply least privilege to WordPress user roles.
Validation and detection
- Inventory WordPress sites using the Profile Builder plugin.
- Confirm installed plugin versions and flag versions 3.9.0 or older.
- Check whether the Usermeta shortcode is enabled or used in content.
- Review whether low-privilege subscriber accounts can register or log in.
- Look for unusual privileged account activity after exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-0814 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bbedad66-a5a6-4fb5-b03e-0ecf9fbef19a?source=cveCVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2864329%40profile-builder&new=2864329%40profile-builder&sfp_email=&sfph_mail=CVE reference
- https://lana.codes/lanavdb/512e7307-04a5-4d8b-8f79-f75f37784a9f/CVE reference
- https://www.wordfence.com/blog/2023/03/vulnerability-patched-in-cozmolabs-profile-builder-plugin-information-disclosure-leads-to-account-takeover/CVE reference
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bbedad66-a5a6-4fb5-b03e-0ecf9fbef19aCVE reference · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.