The User Profile Builder plugin for WordPress suffers from an improper access control vulnerability (CWE-284) because the 'wppb_two_factor_authentication_settings_update' function lacks a capability check. This flaw allows unauthenticated attackers to change 2FA settings for any user role, potentially weakening security controls. The vulnerability affects all versions up to and including 3.10.8. The CVSS 3.1 base score is 8.2, reflecting high severity with network attack vector, no privileges required, no user interaction needed, and impact limited to integrity and low availability. No patch or official remediation has been provided by the vendor as of the published date.

An unauthenticated attacker can modify two-factor authentication settings for arbitrary user roles in the plugin, potentially disabling 2FA protections and increasing the risk of unauthorized access to user accounts. This compromises the integrity of authentication controls and may lead to further exploitation. The vulnerability does not directly impact confidentiality but can reduce the overall security posture of affected WordPress sites using the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or limiting the use of the affected plugin, especially the Premium 2FA features, or implement compensating controls to monitor and restrict unauthorized changes to authentication settings. Avoid exposing the WordPress installation to untrusted networks where unauthenticated attackers can reach the plugin functionality.