# User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Unclaimed Upload Takeover

- **ID:** WPSEC-2026-2004
- **Plugin:** User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (`profile-builder`), https://wordpress.org/plugins/profile-builder/
- **Affected versions:** all versions before 4.0.6
- **Fixed in:** 4.0.6 (Update to 4.0.6 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/profile-builder
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2004/

## Description

The User Profile Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Upload and Avatar fields of the registration form in all versions up to, and including, 4.0.5, due to the wppb_verify_attachment_id() ownership check accepting any attachment that has no author whenever the request is unauthenticated. This makes it possible for unauthenticated attackers to claim files that other visitors uploaded but had not yet claimed during registration, by submitting the attachment ID in an upload field. The attacker's new account becomes the owner of the file.

## References

- https://wpsec.com/vuln/WPSEC-2026-2004/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.6/
- https://wordpress.org/plugins/profile-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2004/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.