Profile Builder CVE-2026-54854

Exploitation requires an authenticated Contributor-level account on a WordPress site running Profile Builder version 4.0.5 or earlier (PR:L); the attacker leverages the plugin's incorrect privilege-assignment logic (CWE-266) to escalate beyond the Contributor role. Limiting factors: the attacker must first obtain or be granted a Contributor account (relevant on sites that permit user registration or multi-author workflows), and the flaw is confined to deployments of this specific plugin at the affected versions. No user interaction is required (UI:N) and no non-default configuration is named in the available sources; the exact trigger mechanism and the precise elevated privilege obtained are not described in the available sources.

This is a moderate-severity, authenticated privilege-escalation flaw (CVSS 6.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) in the Profile Builder WordPress plugin by Cozmoslabs, classified as CWE-266 (Incorrect Privilege Assignment). The CVSS vector indicates a network-reachable attack with low complexity and no user interaction, but it requires existing low-level authentication (PR:L), and the description explicitly scopes the attacker to a Contributor account - so this is NOT remote-unauthenticated. No EPSS score was supplied and the CVE is not on CISA KEV, so there is no public signal of mass or active exploitation; exploitation status is 'no public exploit identified at time of analysis.' The vuln.today priority of 'this_month' and Patchstack as the reporting source are consistent with a real-but-not-emergency issue: a genuine privilege-escalation bug worth patching on a normal cycle rather than a drop-everything event. The scope is unchanged (S:U) and all three impacts are rated Low, meaning the escalation is bounded rather than a full takeover per the CVSS data - though CWE-266 escalation in a user-management plugin can be serious if it reaches Administrator; the supplied data does not state the exact target privilege level, so the real impact ceiling is not confirmed. MISSING DATA: no EPSS, no SSVC decision breakdown, no confirmed fixed version, and the single reference is a Patchstack database advisory rather than a vendor advisory or working exploit.

An attacker who already holds (or registers for) a Contributor-level account on a WordPress site running Profile Builder <= 4.0.5 abuses an incorrect privilege-assignment flaw to grant themselves higher privileges than their role should allow. No victim interaction is needed, but the attacker must first be authenticated as a low-privilege user. No public exploit code has been identified for this CVE at the time of analysis.