WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

profile-builder · Missing authorization · CWE-862

Affectedprofile-builder

FixUpdate to 4.0.6 or newer

PublishedOct 29, 14:32 · Patchstack

ScoredOct 29 · 5.3 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:06 UTC

What we know

No known exploitation. CISA KEV, checked 22:06 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Description

Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.

From Patchstack

Affected and fixed versions

ProductAffectedFixed inprofile-builderearlier versions4.0.6

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/profile-builder/vulnerability/wordpress-profile-builder-plugin-4-0-5-broken-access-control-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in profile-builder

All 8 →

7.1WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability · CVE-2026-54855Oct 30 6.3WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability · CVE-2026-54854Oct 30 8.8WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability · CVE-2026-112242Oct 22