CVE-2026-125777: WordPress Profile Builder plugin <= 4.0.6 - Sensitive Data Exposure vulnerability

Q: Which installations are affected?

Profile Builder versions through 4.0.6 are affected. The available data does not identify a fixed version.

Q: Can this be exploited remotely without an account or user interaction?

Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected impact?

The reported impact is limited to confidentiality: embedded sensitive data may be retrieved. No integrity or availability impact is indicated.

Published Nov 11, 2026

Updated

Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Profile Builder plugin to a version that resolves this vulnerability.
Fixed in 4.0.7

Event History

Nov 11, 2026

CVE Published

via MITRE·11:43 AM

Data Sourced

via MITRE·11:43 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Profile Builder versions through 4.0.6 are affected. The available data does not identify a fixed version.

Can this be exploited remotely without an account or user interaction?

Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected impact?

The reported impact is limited to confidentiality: embedded sensitive data may be retrieved. No integrity or availability impact is indicated.

CVE-2026-125777: WordPress Profile Builder plugin <= 4.0.6 - Sensitive Data Exposure vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Can this be exploited remotely without an account or user interaction?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Can this be exploited remotely without an account or user interaction?

What is the expected impact?