Vulnerabilities / User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor / WPSEC-2026-2006
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Authenticated (Author+) Open Redirect via Content Restriction Custom Redirect URL
Medium 5.4
CWE-601Fixed in 4.0.6
- ID
- WPSEC-2026-2006
- Plugin
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (profile-builder)
- Affected
- all versions before 4.0.6
- Remediation
- Update to 4.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-601
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor on WPSec AttackSurface
- Fix released
- Published
Description
The User Profile Builder plugin for WordPress is vulnerable to Open Redirect via the content restriction custom redirect URL in all versions up to, and including, 4.0.5, due to the URL being stored with only esc_url_raw() and passed to wp_redirect() without host validation. This makes it possible for authenticated attackers with author-level access and above to make their restricted posts redirect visitors to an arbitrary external site.
References
- https://wpsec.com/vuln/WPSEC-2026-2006/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.6/
- https://wordpress.org/plugins/profile-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS