What is the CVSS score of CVE-2026-3139?

CVE-2026-3139 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3139

EUVD-2026-17365 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-31 Wordfence

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 11:45 euvd

EUVD-2026-17365

Analysis Generated

Mar 31, 2026 - 11:45 vuln.today

CVE Published

Mar 31, 2026 - 11:18 nvd

MEDIUM 4.3

DescriptionCVE.org

The User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb_save_avatar_value() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to reassign ownership of arbitrary posts and attachments by changing 'post_author'.

AnalysisAI

User Profile Builder plugin for WordPress up to version 3.15.5 allows authenticated subscribers and above to reassign ownership of arbitrary posts and attachments through insecure direct object reference (IDOR) in the wppb_save_avatar_value() function. The vulnerability lacks validation on user-controlled keys, enabling privilege escalation where low-privileged users can modify post_author fields to take control of content created by other users. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exploits an Insecure Direct Object Reference (CWE-639) in the User Profile Builder plugin's avatar-saving mechanism. The wppb_save_avatar_value() function processes user input directly without sufficient authorization checks on object identifiers. WordPress plugins typically interact with post and user metadata through the wp_postmeta and wp_usermeta tables; this IDOR flaw allows direct manipulation of post_author metadata by an authenticated user without verifying they have ownership or administrative privileges over the target post. The affected product is the User Profile Builder - Beautiful User Registration Forms plugin (cpe:2.3:a:cozmoslabs:user_profile_builder_-_beautiful_user_registration_forms,_user_profiles_&_user_role_editor) in versions up to and including 3.15.5, maintained by Cozmoslabs.

RemediationAI

Update the User Profile Builder plugin to version 3.15.6 or later, which includes validation fixes for the wppb_save_avatar_value() function. The patch is available through the official WordPress plugin repository (https://plugins.trac.wordpress.org/changeset/3481772/profile-builder) and via the plugin's dashboard update mechanism. Site administrators should prioritize this update for all installations, particularly those with multiple contributor or subscriber accounts. As a temporary mitigation pending patch deployment, restrict subscriber-level privileges or disable avatar functionality via plugin settings if operationally feasible. Audit post ownership and attachments for unauthorized changes using WordPress post history logs or database audit tools, particularly targeting posts modified during the vulnerability window.