Read the docs
TI-2026-53493 Aliases CVE-2026-76548GHSA-mpcm-vcpj-wm9p

Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass

Priority MEDIUM 42CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.

Summary

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00321 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed User Profile Builder (Unknown): 4.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownUser Profile Builder3.8.1 to before 4.0.14.0.1Patch availableCNA
  • User Profile Builder VendorUnknown Affected 3.8.1 to before 4.0.1 Fixed in 4.0.1 Patch available CNA

Remediation

  • Fix · CNA User Profile Builder (Unknown) Fixed in 4.0.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    User Profile Builder 4.0.1

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-53492 Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/ExportPriority LOW 31
    • TI-2026-53491 Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date ShortcodePriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76548
  2. 2026-10-03 Alias added: GHSA-mpcm-vcpj-wm9p

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences