CVE-2026-66701
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
An unauthenticated Broken Access Control vulnerability in the Profile Builder plugin (versions up to 3.16.5) allows an unauthenticated attacker to gain access to functions or data that should be protected.
Risk Assessment
An unauthenticated attacker can gain access to sensitive data or administrative functions, potentially leading to data confidentiality and integrity breaches and site takeover.
Recommendation
It is recommended to immediately update the Profile Builder plugin to the latest version that includes the fix. Also, review permission configuration and ensure all sensitive functions are properly secured.
Other vulnerabilities in Profile Builder
See all- CVE-2026-96338Medium
Cross Site Scripting (XSS) vulnerability in Profile Builder up to version 4.0.2. A Subscriber user can inject malicious script.
- CVE-2026-82607High
A vulnerability in the Profile Builder plugin up to 3.16.1 on WordPress in the wppb_ajax_simple_avatar function of /wp-admin/admin-ajax.php allows unrestricted file upload. The attack can be performed remotely, and the exploit is public.
Original NVD description (English source)
Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS