CVE-2026-111982: Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change

Q: Which environments are exposed to this issue?

WordPress Multisite deployments using Cozmoslabs Profile Builder versions before 4.0.5 are affected. The exposed privilege boundary is between a subsite Administrator and accounts outside that administrator's authorized scope, including Network Super Admin accounts.

Q: What access does an attacker need to take over another account?

The attacker needs Administrator access on a Multisite subsite and access to the plugin's front-end Edit Profile form. They can change another user's email address, then use the password-reset flow to gain control of that account.

Q: What is the available remediation?

Update Profile Builder to version 4.0.5 or later. The issue affects versions before 4.0.5.

Published Oct 23, 2026

Updated

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

Affected Software

1 affected component

Cozmoslabs Profile Builder<4.0.5

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which environments are exposed to this issue?

WordPress Multisite deployments using Cozmoslabs Profile Builder versions before 4.0.5 are affected. The exposed privilege boundary is between a subsite Administrator and accounts outside that administrator's authorized scope, including Network Super Admin accounts.

What access does an attacker need to take over another account?

The attacker needs Administrator access on a Multisite subsite and access to the plugin's front-end Edit Profile form. They can change another user's email address, then use the password-reset flow to gain control of that account.

What is the available remediation?

Update Profile Builder to version 4.0.5 or later. The issue affects versions before 4.0.5.

CVE-2026-111982: Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change

Affected Software

Event History

Frequently Asked Questions

Which environments are exposed to this issue?

What access does an attacker need to take over another account?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which environments are exposed to this issue?

What access does an attacker need to take over another account?

What is the available remediation?