User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass

The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wpinsertuser through absint before testing it with iswperror, so the error check runs...

User Profile Builder < 3.11.8 - File Upload

The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. id: CVE-2024-6366 info: name: User Profile Builder 3.11.8 - File Upload author: s4e-io severity: high...

Profile Builder < 3.4.9 - Improper Authentication

The Profile Builder plugin before 3.4.9 for WordPress allows unauthenticated attackers to gain administrative access by exploiting an improper authentication vulnerability in the password reset functionality. An attacker can reset the password of any user, including administrators, without proper...

CVE-2026-54853

Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5...

EUVD-2026-112883

Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5...

CVE-2026-54853 WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5...

CVE-2026-54853

The Cozmoslabs Profile Builder WordPress plugin is affected by a Missing Authorization vulnerability (CWE-862) in versions up to and including 4.0.5 . This flaw allows attackers to exploit incorrectly configured access control security levels , potentially leading to unauthorized actions. No spec...

WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sangho Lee in WordPress Plugin Profile Builder versions = 4.0.5...

CVE-2025-15030

CVE-2025-15030 User Profile Builder 3.15.2 - Unauthenticated Arbitrary Password Reset CVE-2025-15030 User Profile Builder — Unauthenticated Password Reset → Admin Takeover + Shell Upload / / \ |/ / / / / / \ / / / \ / \ | / | | //| \ / /| / | / /| \ | || | / | / || / | | | // | /\/...

CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - Unauthenticated Media Upload Description The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. Usage: usage:...

CVE-2024-6366

To create a Metasploit module to exploit the RCE vulnerability in the User Profile Builder WordPress plugin before version 3.11.8, we need to take advantage of the lack of proper authorization in the media file upload functionality. Here is how you can create such a Metasploit module: Metasploit...

WordPress Profile Builder plugin 4.0.0-4.0.4 - Subscriber+ Comment reCAPTCHA Bypass vulnerability

Subscriber+ Comment reCAPTCHA Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Profile Builder versions 4.0.0-4.0.4...

CVE-2026-115807

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...

EUVD-2026-109212

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...

CVE-2026-115807 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...

CVE-2026-115807

The User Profile Builder WordPress plugin is vulnerable to Limited Privilege Escalation in versions up to and including 4.0.3 . The vulnerability exists because the Gutenberg Register block passes an attacker-controlled Assigned Role attribute directly into the [wppb-register] shortcode without s...

PT-2026-122496

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...

CVE-2026-111965

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form...

EUVD-2026-108667

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form...

CVE-2026-111965 Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form...