CVE-2026-54853: WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Profile Builder pluginto a version that resolves this vulnerability.Fixed in 4.0.6
Event History
Frequently Asked Questions
Which installations are affected?
Profile Builder versions through 4.0.5 are affected. The available information does not identify a fixed version or specify whether particular configurations are exempt.
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the likely security impact?
The reported impact is limited to integrity, meaning an attacker may be able to make unauthorized modifications. No confidentiality or availability impact is indicated by the provided CVSS vector.