Authentication vulnerability in Profile Builder – User Profile & User Registration Forms 1.1.60

The Profile Builder – User Profile & User Registration Forms Plugin for WordPress is a plugin that is used to create custom forms for user profiles and user registration. Unfortunately, in versions up to, and including, 1.1.59 of the plugin, there is a security flaw that could allow unauthenticated attackers to gain access to user accounts, including administrator accounts. This is due to a failure to restrict access on the password reset form, which allows attackers to reset passwords for any user account without requiring authentication.