Profile Builder CVE-2026-111965

Exploitation requires a valid authenticated WordPress account on the target site (PR:L) and requires that the administrator has enabled Profile Builder's reCAPTCHA verification on the comment form; the site must run an affected version (4.0.0 through 4.0.4). The vulnerability is that reCAPTCHA is not enforced on all comment submission paths, so the bypass only exists where that anti-spam integration was configured. Limiting factors: no exploitation is possible without authentication, no impact exists if the administrator never configured reCAPTCHA for comments, and only versions 4.0.0-4.0.4 are affected (fixed in 4.0.5). The exact unprotected code path is not detailed in the available sources.

This is a low-severity, limited-impact issue rather than a true priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) indicates network-reachable, low-complexity exploitation but requires an authenticated account (PR:L), so it is not a remote-unauthenticated flaw. No EPSS score and no KEV listing were provided, so there is no evidence of active or widespread exploitation; a public PoC reference exists but it is not verified as working exploit code, and PoC availability must not be conflated with active exploitation. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cycle priority rather than act_now or emergency. The real-world consequence is bypass of an administrator-configured reCAPTCHA anti-spam control on the WordPress comment form, i.e. spam/abuse rather than data compromise or code execution. One minor discrepancy: the supplied vector assigns C:L, but the described impact (bypassing anti-spam to post comments) reads more like an integrity/abuse issue than a confidentiality disclosure - verify impact dimension with the vendor/WPScan advisory.

An attacker who holds any valid low-privilege WordPress account on a site running Profile Builder 4.0.0-4.0.4 submits comments through a comment-submission path where reCAPTCHA is not enforced, bypassing the anti-spam protection the administrator configured. This allows automated or bulk spam comment posting despite the reCAPTCHA integration. A public PoC reference exists (WPScan), but it is not verified as working exploit code.