CVE-2026-76547
Low risk· EPSS 13%Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the plugin itself, so further impact requires a suitable gadget from another installed plugin.
Risk Assessment
Administrators can be exploited to execute malicious code on the server, potentially leading to full site compromise if suitable gadgets are available in other plugins.
Recommendation
Update the plugin to the latest version if available, and ensure the configuration import add-on is disabled if not used. Additionally, restrict administrator privileges and regularly audit installed plugins.
Other vulnerabilities in User Profile Builder
See all- CVE-2026-15826Critical
The User Profile Builder plugin for WordPress up to version 3.16.4 is vulnerable to authentication bypass via type confusion. The wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress rejects it with a WP_Error object, but absint() coerces that object to the integer 1, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This allows unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover.
- CVE-2026-76548Low risk· EPSS 3%
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.
- CVE-2026-76546Low risk· EPSS 5%
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.
- CVE-2026-15368High
The User Profile Builder WordPress plugin before version 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.
- CVE-2026-3139Medium
The User Profile Builder plugin for WordPress up to version 3.15.5 is vulnerable to Insecure Direct Object Reference in the wppb_save_avatar_value() function due to missing validation on a user controlled key. Authenticated attackers with subscriber-level access and above can reassign ownership of arbitrary posts and attachments by changing 'post_author'.
Original NVD description (English source)
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the User Profile Builder WordPress plugin before 4.0.1 itself, so further impact requires a suitable gadget from another installed User Profile Builder WordPress plugin before 4.0.1 or .