CVE-2026-3139
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The User Profile Builder plugin for WordPress up to version 3.15.5 is vulnerable to Insecure Direct Object Reference in the wppb_save_avatar_value() function due to missing validation on a user controlled key. Authenticated attackers with subscriber-level access and above can reassign ownership of arbitrary posts and attachments by changing 'post_author'.
Risk Assessment
Risk of unauthorized content ownership changes, potentially leading to control over posts and attachments.
Recommendation
Update the User Profile Builder plugin to a version later than 3.15.5.
Original NVD description (English source)
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb_save_avatar_value() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to reassign ownership of arbitrary posts and attachments by changing 'post_author'.