CVE-2026-82607
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in the Profile Builder plugin up to 3.16.1 on WordPress in the wppb_ajax_simple_avatar function of /wp-admin/admin-ajax.php allows unrestricted file upload. The attack can be performed remotely, and the exploit is public.
Risk Assessment
An attacker can upload malicious files to the server, potentially leading to remote code execution and full control of the website.
Recommendation
It is recommended to upgrade the Profile Builder plugin to version 3.16.2 or later, which includes a fix.
Other vulnerabilities in Profile Builder
See all- CVE-2026-96338Medium
Cross Site Scripting (XSS) vulnerability in Profile Builder up to version 4.0.2. A Subscriber user can inject malicious script.
- CVE-2026-66701Medium
An unauthenticated Broken Access Control vulnerability in the Profile Builder plugin (versions up to 3.16.5) allows an unauthenticated attacker to gain access to functions or data that should be protected.
Original NVD description (English source)
A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 3.16.2 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS