TI-2026-56948 Aliases CVE-2026-82607 GHSA-vpqq-55px-363c

Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload

HIGH 70CWE-284Published 2026-08-31 · Updated 2026-08-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass, Code execution
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284 and CWE-434.

Summary

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 3.16.2 is sufficient to resolve this issue. It is suggested to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00495 42nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Profile Builder Plugin (Cozmoslabs): 3.16.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cozmoslabs	Profile Builder Plugin	3.16.0; 3.16.1	3.16.2	Patch available	CNA

Profile Builder Plugin VendorCozmoslabs Affected 3.16.0; 3.16.1 Fixed in 3.16.2 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cozmoslabs:profile_builder_plugin::::::::	—	—	Cozmoslabs

cpe:2.3:a:cozmoslabs:profile_builder_plugin:*:*:*:*:*:*:*:* Versions — — ·Cozmoslabs

Remediation

Fix · CNA Profile Builder Plugin (Cozmoslabs) Fixed in 3.16.2

Timeline

2026-10-02 Threatist record created from CVE-2026-82607
2026-10-03 Alias added: GHSA-vpqq-55px-363c

References

Exploit 1

https://ciphersecuritylabs.com/research/articles/when-the-browser-is-the-only-bouncer-unauthenticated-media-upload-in-profile-builder

Patch 1

https://www.cozmoslabs.com/docs/profile-builder/free-changelog/

TI-2024-06204 profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation CVSS 3.1CRITICAL 9.8
TI-2024-05908 User Profile Builder < 3.11.8 - Unauthenticated Media Upload CVSS 3.1CRITICAL 9.1
TI-2026-15943 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure CVSS 3.1CRITICAL 9.8
TI-2026-13308 Incorrect type conversion in Cozmoslabs User Profile Builder – Beautiful User… CVSS 3.1CRITICAL 9.8
TI-2024-06217 Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting CVSS 3.1MEDIUM 4.8
TI-2022-04059 WCK < 2.3.3 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8

See all 99 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences