{
 "id": "WPSEC-2026-2004",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2004/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2004/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2004/index.md",
 "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Unclaimed Upload Takeover",
 "description": "The User Profile Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Upload and Avatar fields of the registration form in all versions up to, and including, 4.0.5, due to the wppb_verify_attachment_id() ownership check accepting any attachment that has no author whenever the request is unauthenticated. This makes it possible for unauthenticated attackers to claim files that other visitors uploaded but had not yet claimed during registration, by submitting the attachment ID in an upload field. The attacker's new account becomes the owner of the file.",
 "plugin": {
  "slug": "profile-builder",
  "name": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor",
  "full_name": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor",
  "wordpress_org": "https://wordpress.org/plugins/profile-builder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/profile-builder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/profile-builder"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.6",
 "remediation": "Update to 4.0.6 or later.",
 "fix_released": "2026-10-29T08:10:14+00:00",
 "published": "2026-10-30T08:47:55+00:00",
 "updated": "2026-10-29T17:37:52.845692+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2004/",
  "https://plugins.svn.wordpress.org/profile-builder/tags/4.0.6/",
  "https://wordpress.org/plugins/profile-builder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/profile-builder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-30"
 }
}