CVE-2026-112242: WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Profile Builderto a version that resolves this vulnerability.Fixed in 4.0.5
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. An attacker would need an existing low-privileged account or equivalent access.
What is the potential impact of successful exploitation?
Successful exploitation can result in privilege escalation with high impact to confidentiality, integrity, and availability. This could allow an attacker to obtain permissions beyond those assigned to their account.
Which Profile Builder versions are affected?
The issue affects Cozmoslabs Profile Builder through version 4.0.4. The provided data does not identify a fixed version.