User Profile Builder EUVD-2026-108595

Exploitation requires a WordPress Multisite network in which the attacker already holds an Administrator role on a subsite (PR:H), plus the User Profile Builder plugin (before 4.0.5) exposing its front-end Edit Profile form. The attacker uses that form to select and edit an account other than their own, change its email, and complete a password reset. Limiting factors: this is not exploitable on single-site WordPress installations, and it provides no benefit where every subsite Administrator is already fully trusted; it depends on delegated/untrusted subsite administration being present and on the front-end profile-editing feature being in use. No end-user interaction is required (UI:N). The specific code path that fails the authorization check is not detailed in the available sources beyond 'does not verify that a user is authorized to edit the specific account selected'.

CVSS base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The most important signal is PR:H: exploitation requires the attacker to already hold an Administrator account on a WordPress Multisite subsite, so this is not a remote-unauthenticated flaw despite AV:N. The CISA SSVC framing is consistent and informative: Exploitation=none (no observed or public exploitation), Automatable=no (each takeover is a manual, targeted action against a chosen account), but Technical Impact=total (full account takeover, including the Network Super Admin, equals complete control of the installation). No EPSS score, KEV listing, or PoC/exploit reference is present in the input, and SSVC Exploitation=none agrees with that absence - so there is no evidence of in-the-wild or public exploit activity. The vuln.today priority is 'this_week', which matches the picture of a serious privilege-escalation bug that is nonetheless gated behind an authenticated, high-privilege precondition rather than mass-exploitable. Net: a real and high-impact issue for multi-tenant Multisite operators who delegate subsite Administrator rights to untrusted parties, but not an emergency for single-site installs or networks where all subsite admins are already trusted. Note the signals do not conflict (no KEV-vs-EPSS or CVSS-vs-description contradiction); the main caveat is that the attack vector is network-reachable but the privilege prerequisite (subsite Administrator) sharply narrows who can exploit it.

In a WordPress Multisite network, an attacker who controls a subsite Administrator account submits the User Profile Builder front-end Edit Profile form but targets a different user's account rather than their own. Because the plugin does not verify authorization for the selected account, the attacker changes a higher-privileged user's email - for example the Network Super Admin - to an address they control, then runs the standard password-reset flow to seize that account. No public exploit was identified at time of analysis, and SSVC lists Exploitation as none.