CVE-2026-76548

UNKNOWN 0.0

Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

Vendor	unknown
Product	user profile builder
Published	Aug 29, 2026

Stay Ahead of the Next One

Get instant alerts for unknown user profile builder

Be the first to know when new unknown vulnerabilities affecting unknown user profile builder are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / User Profile Builder

3.8.1 < 4.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/75e0611d-e11d-44f8-8fc1-7c40bb113f64/

Credits

Erwan LR (WPScan) WPScan