diff --git a/badges/criteria/award_criteria_profile.php b/badges/criteria/award_criteria_profile.php
index b014cf5a92b..d3ac2f25556 100644
--- a/badges/criteria/award_criteria_profile.php
+++ b/badges/criteria/award_criteria_profile.php
@@ -39,6 +39,26 @@ class award_criteria_profile extends award_criteria {
     public $required_param = 'field';
     public $optional_params = array();
 
+    /* @var array The default profile fields allowed to be used as award criteria.
+     *
+     * Note: This is used instead of user_get_default_fields(), because it is not possible to
+     * determine which fields the user can modify.
+     */
+    protected $allowed_default_fields = [
+        'firstname',
+        'lastname',
+        'email',
+        'address',
+        'phone1',
+        'phone2',
+        'department',
+        'institution',
+        'description',
+        'picture',
+        'city',
+        'country',
+    ];
+
     /**
      * Add appropriate new criteria options to the form
      *
@@ -50,10 +70,7 @@ class award_criteria_profile extends award_criteria {
         $none = true;
         $existing = array();
         $missing = array();
-
-        // Note: cannot use user_get_default_fields() here because it is not possible to decide which fields user can modify.
-        $dfields = array('firstname', 'lastname', 'email', 'address', 'phone1', 'phone2',
-                         'department', 'institution', 'description', 'picture', 'city', 'country');
+        $dfields = $this->allowed_default_fields;
 
         // Get custom fields.
         $cfields = array_filter(profile_get_custom_fields(), function($field) {
@@ -230,8 +247,8 @@ class award_criteria_profile extends award_criteria {
                 $join .= " LEFT JOIN {user_info_data} uid{$idx} ON uid{$idx}.userid = u.id AND uid{$idx}.fieldid = :fieldid{$idx} ";
                 $params["fieldid{$idx}"] = $param['field'];
                 $whereparts[] = "uid{$idx}.id IS NOT NULL";
-            } else {
-                // This is a field from {user} table.
+            } else if (in_array($param['field'], $this->allowed_default_fields)) {
+                // This is a valid field from {user} table.
                 if ($param['field'] == 'picture') {
                     // The picture field is numeric and requires special handling.
                     $whereparts[] = "u.{$param['field']} != 0";