User Profile Builder CVE-2026-76548

Exploitation requires the User Profile Builder plugin's front-end file upload feature to be active on the target WordPress installation - this feature is part of the plugin's user registration and profile functionality and may be enabled by default. No authentication is required (CVSS PR:N confirmed). The attacker needs only network access to the WordPress site. Exploitation is bounded in scope: an attacker can enumerate media library metadata and modify unpublished posts, pages, and media items, but cannot publish content, write arbitrary files to disk, execute code, or access credentials. Sites that have disabled the front-end file upload feature or have upgraded to version 4.0.1 or later are not exposed.

The CVSS 8.2 score is well-supported by the vector: the attack is network-accessible, requires no authentication or user interaction, and produces a high integrity impact (unauthorized content modification) alongside a low confidentiality impact (media library enumeration). These signals align with the description. However, the EPSS score of 0.13% at the 3rd percentile strongly tempers operational urgency - despite a publicly available POC from WPScan, automated or mass exploitation has not materialized at a scale detectable by EPSS telemetry. The absence of a CISA KEV listing reinforces this; exploitation appears opportunistic or targeted rather than widespread. The integrity impact is most relevant to sites relying on draft content confidentiality or collaborative workflows, where an attacker could silently alter content before publication. The confidentiality exposure (media library listing) is narrow - filenames and metadata, not credentials or PII. Organizations with high-value draft pipelines should treat this as a genuine near-term priority despite the low EPSS, while lower-stakes deployments may schedule it in routine patch cycles.

An unauthenticated attacker sends a crafted HTTP POST request to the User Profile Builder front-end file upload endpoint, exploiting the absent capability check to receive a response confirming media library contents and draft content identifiers. Using the enumerated draft post IDs, the attacker issues additional requests to overwrite or corrupt unpublished content before it reaches editors for review. A public POC documented on WPScan specifies the exact request structure, lowering the skill threshold for exploitation.