CVE-2026-3717: CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload
The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wpsavesignatureimage' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed?
WordPress sites using CV Builder – Professional Resume Builder SaaS version 1.3.1 or earlier are affected. The exposed function lacks a capability check, so exploitation does not require an authenticated WordPress account.
What can an attacker upload?
An unauthenticated attacker can upload arbitrary content to the WordPress uploads directory, with the uploaded files treated as PNG files. The provided information does not establish that uploaded content can be executed as code.
How can I check for possible exploitation?
Review the WordPress uploads directory for unexpected PNG files, particularly files that do not correspond to legitimate signature-image uploads. The available data does not provide specific filenames, paths, request indicators, or timestamps for identifying malicious uploads.