WP CV Builder EUVD-2026-96209

No authentication or special configuration required - remote unauthenticated exploitation works against default installations of the CV Builder - Professional Resume Builder SaaS plugin (versions ≤1.3.1) because the 'wp_save_signature_image' AJAX/function endpoint performs no capability check (CWE-862). The only prerequisite is that the vulnerable plugin is installed and active on the target WordPress site. Exploitation is meaningfully LIMITED by the fact that uploaded content is written as .png files to the uploads directory, which constrains it to an integrity/write primitive rather than guaranteed server-side code execution; leveraging it for greater impact would require chaining with another flaw or server misconfiguration.

This is a genuine but moderate-severity issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which is why it is network-exploitable at scale against any site running the plugin. However, impact is deliberately scoped low (C:N/I:L/A:N, base 5.3): the 'wp_save_signature_image' function writes attacker content into the uploads directory but constrains output to .png files, so this is an integrity-only write primitive rather than confidentiality loss or direct code execution. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC referenced, so this is not confirmed exploited and not known-public-exploit at this time. The realistic risk driver is that unauthenticated file writes in WordPress can sometimes be chained (stored content, phishing/defacement hosting, or combined with other flaws) - but on its own, the .png constraint limits it from being a reliable RCE. No signals conflict; the main gap is the absence of EPSS/POC data to gauge likelihood.

An unauthenticated attacker discovers a WordPress site running CV Builder ≤1.3.1 and sends a crafted request directly to the exposed 'wp_save_signature_image' handler, which lacks a capability check. The request writes attacker-supplied content into wp-content/uploads as a .png file, letting the attacker host arbitrary content on the victim domain (e.g., phishing payloads or defacement assets). No POC is referenced in the provided data, and content is constrained to png output, so direct code execution is not demonstrated.