7.2
Élevée
CVE-2026-111982 The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific…
Description
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| User Profile Builder 4.0 | premières → < 4.0.5 | 4.0.5 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de User Profile Builder
Les 11 CVE de User Profile Builder →
CVE-2026-111966
The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes…
6.8
Moyenne
CVE-2026-111948
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a…
7.1
Élevée
CVE-2026-76547
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when…
6.6
Moyenne
CVE-2026-76548
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature,…
8.2
Élevée