CVE-2026-76548

Deferred Deferred - Pending Action

Unauthenticated File Upload in User Profile Builder WordPress Plugin

Publication date: 2026-08-29

Last updated on: 2026-08-30

Assigner: WPScan

Description

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-29

Last Modified

2026-08-30

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-76548

EUVD

EUVD-2026-68052

Affected Vendors & Products

Vendor	Product	Version / Range
wpengine	profile_builder	to 4.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WordPress plugin Profile Builder before version 4.0.1. It allows unauthenticated visitors to bypass authentication and access front-end file upload features. Attackers can list all media files in the site's library and modify unpublished posts, pages, and media items belonging to other users due to improper restrictions on file upload functionality.

Detection Guidance

Check if the Profile Builder plugin version is below 4.0.1 by inspecting the WordPress admin panel under Plugins. Look for unauthorized file uploads in the media library or modifications to unpublished posts/pages. Use WPScan to scan for vulnerable versions: wpscan --url <your-site> --enumerate vp,vt

Review server logs for unusual front-end file upload activity or requests to /wp-admin/admin-ajax.php with suspicious parameters. Check for unauthorized changes in the database via phpMyAdmin or similar tools.

Impact Analysis

This vulnerability can allow attackers to access sensitive media files, modify unpublished content, and potentially escalate privileges by altering posts or pages. It poses a risk to data integrity and confidentiality on affected WordPress sites.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance due to potential data breaches and lack of proper access controls.

Mitigation Strategies

Update the Profile Builder plugin to version 4.0.1 or later immediately. Disable the front-end file upload feature if not required. Restrict access to the WordPress admin panel and database to trusted users only.

Monitor for unauthorized changes in posts, pages, or media items. Consider temporarily disabling the plugin until the update is applied if immediate mitigation is needed.

Hi! I’m here to help you understand CVE-2026-76548. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70