User Profile Builder CVE-2026-76546

Exploitation requires all of the following simultaneously: (1) the specific optional User Profile Builder shortcode must be explicitly enabled on the target site - it is NOT active by default, so a large fraction of User Profile Builder deployments are not exposed; (2) the attacker must hold a contributor-level (or higher) WordPress account on that specific site; and (3) a victim user must navigate to and view the page or post containing the injected shortcode. Factors that limit exploitation: the non-default shortcode configuration, the requirement for an authenticated account on the target site, and mandatory active victim-side user interaction. No exploitation is possible against sites where the shortcode has not been enabled, regardless of plugin version.

The stated CVSS score of 6.8 is derived from a PR:H vector, which directly conflicts with the CVE description's explicit claim that exploitation is possible for users 'as low as contributor' - a low-privilege WordPress role well below administrator. This inconsistency undermines the provided score; PR:L more accurately reflects the described attacker privilege level, which would affect the calculated base score. EPSS at 0.15% (5th percentile) places this well below typical mass-exploitation thresholds, and the absence from CISA KEV means no confirmed in-the-wild campaign is documented. A public PoC is confirmed by WPScan, which reduces the technical barrier for opportunistic attackers. The non-default shortcode configuration is the single most important mitigating factor - sites that have not enabled this feature are entirely unaffected regardless of plugin version, making real-world impact highly contingent on site configuration. This is a genuine but configuration-gated risk, warranting higher urgency specifically for multi-contributor WordPress sites where the shortcode is active.

An attacker with a contributor account on a WordPress site where the vulnerable shortcode is enabled crafts a post embedding JavaScript through the unescaped shortcode parameter. When an administrator or editor views the published content, the payload executes in their browser session, potentially exfiltrating session cookies or silently creating a rogue admin account. A public PoC is available via WPScan, reducing the technical skill required for exploitation.