User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor CVE-2026-3139

The CVSS 4.3 score reflects a network-accessible vulnerability requiring low-privilege authentication (PR:L) with low attack complexity but limited impact (integrity only, no confidentiality or availability loss). The EPSS data is not provided, preventing quantitative exploitation probability assessment. Exploitation is automatable and requires only subscriber-level account access, a common privilege level in WordPress multiuser environments and compromised accounts. However, real-world risk is moderate rather than critical: the attack requires prior authentication and targets only post ownership integrity, not data exfiltration or system compromise. In SSVC terms, this is a formal integrity violation with human-controlled technical impact; organizations with strong access controls and audit logging can detect and remediate reassigned posts. The threat is most significant in community-driven or multiauthor WordPress sites where subscriber accounts are prevalent or frequently compromised.

A malicious subscriber on a WordPress blog gains account access through credential compromise or social engineering. The attacker crafts a direct API call or manipulated form submission to the wppb_save_avatar_value() endpoint, injecting a post_author identifier for a high-value article written by the site editor. Without validation, the function reassigns the article's authorship to the attacker's subscriber account, allowing them to edit, delete, or republish the content as their own work. This scenario is fully automatable with basic HTTP tooling and requires no user interaction beyond the initial account compromise.