CVE-2026-125776: WordPress Profile Builder plugin <= 4.0.6 - Broken Access Control vulnerability

Q: Which deployments are affected?

Profile Builder versions through 4.0.6 are affected. The available information does not identify a safe fixed version.

Q: Can an unauthenticated remote attacker exploit this issue?

Yes. The CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected impact?

The stated impact is limited confidentiality impact; integrity and availability impact are not indicated in the provided CVSS vector.

Published Nov 11, 2026

Updated

Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Profile Builder plugin to a version that resolves this vulnerability.
Fixed in 4.0.7

Event History

Nov 11, 2026

CVE Published

via MITRE·12:36 PM

Data Sourced

via MITRE·12:36 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Profile Builder versions through 4.0.6 are affected. The available information does not identify a safe fixed version.

Can an unauthenticated remote attacker exploit this issue?

Yes. The CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected impact?

The stated impact is limited confidentiality impact; integrity and availability impact are not indicated in the provided CVSS vector.

CVE-2026-125776: WordPress Profile Builder plugin <= 4.0.6 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Can an unauthenticated remote attacker exploit this issue?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Can an unauthenticated remote attacker exploit this issue?

What is the expected impact?