CVE-2026-76548

CVE-2026-76548 affects the User Profile Builder WordPress plugin in versions before 4.0.1 . The front-end file upload feature fails to properly restrict access, granting unauthenticated visitors capabilities normally reserved for privileged roles. This allows attackers to list the site's media li...

CVE-2026-76547

CVE-2026-76547 affects the User Profile Builder WordPress plugin before version 4.0.1 . The root cause is unvalidated deserialization when importing a configuration file, enabling PHP Object Injection by high-privilege users (e.g., administrators). Two significant mitigating factors reduce practi...

CVE-2026-76546

The User Profile Builder WordPress plugin before 4.0.1 is vulnerable to a Stored XSS via its optional Format Date Shortcode , which fails to escape its output. An attacker with at least the contributor role can inject script that executes when any user—including administrators —views the affected...

EUVD-2026-68051

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

CVE-2026-76547 Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

CVE-2026-76546 Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortco...

Winter: My Account preview exposes another backend user's profile by record ID

Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...

CVE-2026-15826

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

CVE-2026-15826 User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

CVE-2026-15826

The User Profile Builder WordPress plugin (≤ 3.16.4) is vulnerable to unauthenticated authentication bypass via type confusion , rated CVSS 9.8 Critical . The root cause is in wppb_log_in_user(), which calls absint() on the return value of wp_insert_user() before the is_wp_error() check. A regist...

EUVD-2026-59593

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

PT-2026-72877

Name of the Vulnerable Software and Affected Versions User Profile Builder versions prior to 3.16.5 Description An authentication bypass exists due to type confusion within the wppb log in user function. When a registration request is submitted using the username parameter with a length between 6...

40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin

On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder, a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically th...

CVE-2026-17445

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name...

CVE-2026-17445

IBM i (versions 7.3–7.6, 5770-SS1) is vulnerable to CVE-2026-17445 via Line Printer Daemon (LPD). An remote authenticated attacker could bypass security restrictions due to improper validation of an attacker-supplied user profile name. CVSS v3.1 base score 8.2 (HIGH) with network attack vector, n...

EUVD-2026-57519

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name...

CVE-2026-17445

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name...

CVE-2026-62832

Improper link resolution before file access 'link following' in Windows User Profile Service allows an authorized attacker to elevate privileges locally...

EUVD-2026-56678

Improper link resolution before file access 'link following' in Windows User Profile Service allows an authorized attacker to elevate privileges locally...

CVE-2026-62832

The CVE-2026-62832 entry describes an elevation-of-privilege flaw in Windows' User Profile Service due to improper link resolution before file access (link following). A local, low-privilege attacker could elevate privileges on the host. The issue is tied to a CVSS v3.1 base score of 7.8 (High) w...