User Profile Builder EUVD-2026-68051

Exploitation requires WordPress administrator-level authentication (confirmed by CVSS PR:H). The vulnerable import feature is a free add-on shipped with User Profile Builder but disabled by default - it must be explicitly activated by a site administrator before the attack surface exists. Even when the add-on is enabled, there is no POP chain within User Profile Builder itself prior to 4.0.1; a compatible gadget chain must be present in a separately installed plugin or theme for code execution to be achievable. Without a gadget, exploitation results only in PHP object injection without direct code execution impact. These three conditions - admin credentials, non-default feature activation, and an external gadget source - collectively constrain real-world exploitability significantly beyond what the raw CVSS C:H/I:H/A:H impact metrics suggest.

The CVSS 3.1 base score of 6.6 Medium is well-calibrated for this vulnerability. The vector AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H correctly reflects the steep access requirements: an attacker must already hold WordPress administrator credentials (PR:H), and the high attack complexity (AC:H) accounts for the non-default feature toggle and the external gadget dependency. EPSS at 0.23% (13th percentile) confirms that opportunistic mass exploitation is not occurring despite the public POC. This is not a CISA KEV entry, and there is no confirmed active exploitation. In practice, an attacker with existing admin access has many simpler paths to code execution (direct plugin installation, theme editor), making this vulnerability most relevant in scenarios where PHP object injection via a gadget chain bypasses logging or detection controls. Priority should be moderate: patch promptly but it does not warrant emergency response outside regulated or multi-tenant hosting environments.

An attacker who has obtained WordPress administrator credentials - through phishing, credential stuffing, or escalation from a lesser privilege - navigates to the User Profile Builder configuration import add-on (which must first be enabled), crafts a PHP serialized payload targeting a magic method in a POP-chain-capable co-installed plugin, and uploads it as a configuration file. Upon deserialization, the gadget chain executes arbitrary PHP code in the server's web process context, potentially achieving full server compromise. A public POC has been published via WPScan.