User Profile Builder Plugin Vulnerability in WordPress Allows Unauthorized Account Access
CVE-2026-111982
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111982?
The User Profile Builder plugin for WordPress, prior to version 4.0.5, contains a flaw in its front-end Edit Profile form. This vulnerability fails to adequately verify user authorization when editing account details. An Administrator on a Multisite subsite can exploit this issue to change the email addresses of other users, including that of a Network Super Admin. This allows potential account takeovers through the password-reset mechanism, posing a serious threat to user security.
Affected Version(s)
User Profile Builder 0 < 4.0.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.