User Profile Builder
Monthly
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
PHP Object Injection in User Profile Builder WordPress plugin (versions 3.3.4 through before 4.0.1) allows authenticated administrators to inject arbitrary PHP objects by uploading a malicious configuration file through the plugin's import feature. Exploitation is gated by two non-trivial conditions: the affected free add-on must be explicitly enabled (it is disabled by default), and a suitable POP chain gadget must exist in another installed plugin or theme before code execution is achievable. A public POC exists per WPScan, but no public exploit identified at time of analysis maps to confirmed in-the-wild abuse - EPSS sits at just 0.23% (13th percentile), consistent with the high practical bar imposed by admin-level access and gadget dependencies.
Stored XSS in the User Profile Builder WordPress plugin (versions before 4.0.1) allows users with contributor-level WordPress roles to embed persistent JavaScript via an improperly escaped optional shortcode, executing in the browser of any user who views the affected content - including administrators. A publicly available exploit exists per WPScan intelligence, though EPSS remains at 0.15% (5th percentile) and the vulnerability is absent from CISA's KEV catalog. The non-default shortcode requirement meaningfully limits exposure to sites that have explicitly enabled the affected feature.
Session hijacking in the User Profile Builder WordPress plugin (versions before 3.16.4) allows unauthenticated attackers to obtain an authenticated session for any arbitrary existing user - including site administrators - by exploiting improper account binding in the post-registration auto-login flow. Exploitation is constrained to sites running a supported but non-default plugin configuration, which explains the AC:H in the CVSS vector and the SSVC 'Automatable: no' designation despite total technical impact. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.14% (4th percentile) and SSVC 'Exploitation: none' indicate no confirmed widespread exploitation at time of analysis.
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
PHP Object Injection in User Profile Builder WordPress plugin (versions 3.3.4 through before 4.0.1) allows authenticated administrators to inject arbitrary PHP objects by uploading a malicious configuration file through the plugin's import feature. Exploitation is gated by two non-trivial conditions: the affected free add-on must be explicitly enabled (it is disabled by default), and a suitable POP chain gadget must exist in another installed plugin or theme before code execution is achievable. A public POC exists per WPScan, but no public exploit identified at time of analysis maps to confirmed in-the-wild abuse - EPSS sits at just 0.23% (13th percentile), consistent with the high practical bar imposed by admin-level access and gadget dependencies.
Stored XSS in the User Profile Builder WordPress plugin (versions before 4.0.1) allows users with contributor-level WordPress roles to embed persistent JavaScript via an improperly escaped optional shortcode, executing in the browser of any user who views the affected content - including administrators. A publicly available exploit exists per WPScan intelligence, though EPSS remains at 0.15% (5th percentile) and the vulnerability is absent from CISA's KEV catalog. The non-default shortcode requirement meaningfully limits exposure to sites that have explicitly enabled the affected feature.
Session hijacking in the User Profile Builder WordPress plugin (versions before 3.16.4) allows unauthenticated attackers to obtain an authenticated session for any arbitrary existing user - including site administrators - by exploiting improper account binding in the post-registration auto-login flow. Exploitation is constrained to sites running a supported but non-default plugin configuration, which explains the AC:H in the CVSS vector and the SSVC 'Automatable: no' designation despite total technical impact. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.14% (4th percentile) and SSVC 'Exploitation: none' indicate no confirmed widespread exploitation at time of analysis.