Vulnerabilities / User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor / WPSEC-2026-2004
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Unclaimed Upload Takeover
Medium 6.5
CWE-639Fixed in 4.0.6
- ID
- WPSEC-2026-2004
- Plugin
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (profile-builder)
- Affected
- all versions before 4.0.6
- Remediation
- Update to 4.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor on WPSec AttackSurface
- Fix released
- Published
Description
The User Profile Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Upload and Avatar fields of the registration form in all versions up to, and including, 4.0.5, due to the wppb_verify_attachment_id() ownership check accepting any attachment that has no author whenever the request is unauthenticated. This makes it possible for unauthenticated attackers to claim files that other visitors uploaded but had not yet claimed during registration, by submitting the attachment ID in an upload field. The attacker's new account becomes the owner of the file.
References
- https://wpsec.com/vuln/WPSEC-2026-2004/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.6/
- https://wordpress.org/plugins/profile-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS