CVE-2026-111982

HighCVSS 7.2

Published: 23/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form. This allows a Multisite subsite Administrator to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

Risk Assessment

A subsite administrator can take over the Network Super Admin or other users' accounts, leading to privilege escalation and full network compromise. The risk applies to multisite installations.

Recommendation

Update the User Profile Builder plugin to version 4.0.5 or later. Until patched, restrict access to the profile edit form.

Other vulnerabilities in User Profile Builder WordPress plugin

CVE-2026-111966Medium
The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message. This could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.

Original NVD description (English source)

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS