EUVD-2026-68052
GHSA-mpcm-vcpj-wm9p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Network-reachable endpoint, no authentication per description and PR:N vector; high integrity impact from unauthorized draft content modification; low confidentiality from media listing only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.
AnalysisAI
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the User Profile Builder plugin's front-end file upload feature to be active on the target WordPress installation - this feature is part of the plugin's user registration and profile functionality and may be enabled by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score is well-supported by the vector: the attack is network-accessible, requires no authentication or user interaction, and produces a high integrity impact (unauthorized content modification) alongside a low confidentiality impact (media library enumeration). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade User Profile Builder to version 4.0.1 or later, as confirmed by the WPScan advisory at https://wpscan.com/vulnerability/75e0611d-e11d-44f8-8fc1-7c40bb113f64/ and the vendor patch noted in available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in User Profile Builder
View allSession hijacking in the User Profile Builder WordPress plugin (versions before 3.16.4) allows unauthenticated attackers
Stored XSS in the User Profile Builder WordPress plugin (versions before 4.0.1) allows users with contributor-level Word
PHP Object Injection in User Profile Builder WordPress plugin (versions 3.3.4 through before 4.0.1) allows authenticated
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today