Profile Builder Pro CVE-2026-27413

Remote unauthenticated exploitation against default configurations of Profile Builder Pro plugin versions 3.13.9 and earlier. The vulnerability exists in core plugin functionality handling user-supplied input to database queries, requiring no special features to be enabled beyond basic plugin activation on a WordPress site. Attack surface is exposed whenever Profile Builder Pro processes HTTP requests containing injectable parameters, typically through public-facing user registration forms, profile search interfaces, or user profile editing endpoints. No user interaction required (UI:N in CVSS vector). Exploitation is limited only by plugin installation - sites not running Profile Builder Pro are unaffected, and the commercial nature of this premium plugin significantly reduces global attack surface compared to freely distributed WordPress plugins.

Real-world risk assessment reveals significant divergence between severity indicators. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) yields a 9.3 Critical score, indicating network-accessible exploitation requiring no authentication, low attack complexity, scope change allowing cross-tenant impact, high confidentiality breach, and low availability impact. However, EPSS probability of 0.03% (8th percentile) suggests minimal observed exploitation activity in the wild. This discrepancy likely reflects the commercial nature of Profile Builder Pro having smaller deployment footprint than free WordPress plugins, reducing attacker targeting. No CISA KEV listing confirms no government-sector active exploitation. Patchstack reporting indicates security researcher discovery rather than in-the-wild detection. SSVC assessment: exploitation status is publicly available (Patchstack disclosure), technical impact is total (database access), automatable is yes (SQL injection tools widely available). Priority depends on whether Profile Builder Pro is deployed; organizations using this plugin face genuine Critical risk requiring immediate patching, while the broader WordPress ecosystem faces minimal threat due to limited deployment.

An unauthenticated remote attacker identifies a WordPress site running Profile Builder Pro by fingerprinting plugin-specific URLs or form elements. The attacker crafts malicious HTTP requests to profile registration or search endpoints, injecting SQL payloads into input parameters such as username search fields or custom profile metadata. Using blind SQL injection techniques, the attacker submits boolean-based queries (e.g., crafted inputs causing conditional database delays or error-based responses) to enumerate database structure, extract WordPress user credentials including administrator password hashes, steal personally identifiable information from user profiles, and exfiltrate sensitive configuration data. Publicly available SQL injection tools automate this process, requiring minimal technical sophistication to execute against vulnerable installations.