Cozmoslabs Profile Builder CVE-2026-112242

Requires an authenticated account with at least a low-privilege role (PR:L) on a WordPress site running the Profile Builder plugin version n/a through 4.0.4; no user interaction is needed (UI:N) and the attack is network-reachable (AV:N). The practical limiting factor is obtaining that initial account - this is significantly eased on the many Profile Builder deployments that enable open/self user registration, in which case an attacker can create their own foothold. The exact feature or code path that performs the incorrect privilege assignment is not described in the available sources, so whether a specific configuration or registration mode is required cannot be confirmed from the input.

This is a genuine priority-tier issue rather than an inflated high-CVSS number. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-level authentication (PR:L) and no user interaction, with full High impact to confidentiality, integrity and availability - consistent with a privilege-escalation path from a weak account (e.g., subscriber) to administrator on a WordPress site. The vuln.today decision label is 'this_week', indicating prioritized remediation but not emergency. However, several exploitation signals are MISSING: there is no EPSS probability provided, no CISA KEV listing, and no SSVC automatable/technical-impact decision data in the input, so real-world exploitation likelihood cannot be quantified from these sources. The only reference is the Patchstack database advisory, which is a PoC/advisory reference and is not verified as working exploit code. Net: the structural risk is high (authenticated-to-admin escalation in a widely-used plugin, and many Profile Builder sites permit open user registration, lowering the PR:L barrier in practice), but active-exploitation evidence is absent at time of analysis.

An attacker registers or obtains a low-privilege account (such as subscriber) on a WordPress site running Profile Builder ≤4.0.4 - trivial where self-registration is enabled - then abuses the incorrect privilege assignment to grant themselves an administrator-level role. With admin access they can install plugins, modify content, and fully compromise the site. A public PoC/advisory reference exists at Patchstack; it is not verified as working exploit code, and the precise trigger is not described in the available sources.