title: Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation
description: The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: Profile Builder
versions:
status: affected, versionType: custom, version: 0, lessThan: 3.9.8
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}