Profile Builder Plugin CVE-2026-82607

The Profile Builder Plugin must be installed and active on the WordPress site with the Avatar Simple Upload feature enabled - this registers wppb_ajax_simple_avatar as a nopriv AJAX hook, making it reachable without any WordPress session or login. The /wp-admin/admin-ajax.php endpoint is publicly accessible by default in all WordPress installations; no special server configuration is required to reach the vulnerable function. There is no authentication barrier and no user interaction requirement, making automated or mass exploitation against unpatched sites feasible. Exploitation is constrained to WordPress sites running version 3.16.1 or earlier; sites already on 3.16.2 are not vulnerable. Actual code execution impact may be further limited if the web server restricts script execution in the uploads directory - defenders should verify this hardening is in place as an interim measure.

The CVSS 4.0 base score is 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N, indicating low-complexity unauthenticated network exploitation - a combination that enables automated scanning and mass-exploitation campaigns. The E:P exploit maturity flag in the provided CVSS 4.0 vector confirms a public PoC exists, substantially narrowing the window before opportunistic attacks materialize. A key tension exists in the data: CWE-434 (Unrestricted Upload of File with Dangerous Type) typically implies the potential for server-side code execution, which would justify Critical-level impact, yet the assigned impact metrics (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) indicate only low CIA impact with no scope change. This discrepancy - dangerous-type upload class combined with low impact assessment - may indicate that uploaded files are stored outside the webroot or are renamed to prevent execution, effectively capping impact. This should be independently verified; if PHP execution is achievable, real-world risk significantly exceeds what the CVSS score implies. This CVE is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis, though the public PoC elevates urgency.

An unauthenticated attacker sends a crafted multipart POST request to /wp-admin/admin-ajax.php with the action parameter set to wppb_ajax_simple_avatar, attaching a file with a dangerous extension such as a PHP webshell. If file storage is web-accessible and no server-side execution restriction is in place, the attacker retrieves the uploaded file via its URL and executes arbitrary server-side commands with the permissions of the web server process. A public PoC demonstrating this flow has been released at https://ciphersecuritylabs.com/research/articles/when-the-browser-is-the-only-bouncer-unauthenticated-media-upload-in-profile-builder.