TI-2026-70133 Aliases CVE-2026-3717 GHSA-qrxh-w7jg-4wg7

Missing authorization in CV Builder lets attackers upload PNG files

LOW 29CWE-862Published 2026-10-10 · Updated 2026-10-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The WP CV Builder plugin for WordPress is affected in all versions through 1.3.1. A missing capability check (CWE-862) in the wp_save_signature_image function lets requests skip authorization. An unauthenticated remote attacker can upload arbitrary content to the WordPress uploads directory as PNG files.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00189 8th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Best WP Developer	WP CV Builder	up to 1.3.1	—	No fix listed	CNA

WP CV Builder VendorBest WP Developer Affected up to 1.3.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for WP CV Builder.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-10 Threatist record created from CVE-2026-3717
2026-10-10 Alias added: GHSA-qrxh-w7jg-4wg7
2026-10-11 CISA SSVC decision points changed

References

Other 2

TI-2025-31465 WordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data Vulnerability CVSS 3.1CRITICAL 9.8
TI-2025-23287 WordPress BWD Elementor Addons plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
TI-2024-36375 WordPress Advanced Blog Post Block plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
TI-2024-34773 WordPress Gutenium Blocks plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
TI-2024-11630 BWD Elementor Addons <= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences