{
 "id": "WPSEC-2026-2006",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2006/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2006/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2006/index.md",
 "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Authenticated (Author+) Open Redirect via Content Restriction Custom Redirect URL",
 "description": "The User Profile Builder plugin for WordPress is vulnerable to Open Redirect via the content restriction custom redirect URL in all versions up to, and including, 4.0.5, due to the URL being stored with only esc_url_raw() and passed to wp_redirect() without host validation. This makes it possible for authenticated attackers with author-level access and above to make their restricted posts redirect visitors to an arbitrary external site.",
 "plugin": {
  "slug": "profile-builder",
  "name": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor",
  "full_name": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor",
  "wordpress_org": "https://wordpress.org/plugins/profile-builder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/profile-builder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/profile-builder"
 },
 "type": "REDIRECT",
 "cwe": [
  "CWE-601"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.6",
 "remediation": "Update to 4.0.6 or later.",
 "fix_released": "2026-10-29T08:10:14+00:00",
 "published": "2026-10-30T08:47:55+00:00",
 "updated": "2026-10-29T17:37:52.845692+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2006/",
  "https://plugins.svn.wordpress.org/profile-builder/tags/4.0.6/",
  "https://wordpress.org/plugins/profile-builder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/profile-builder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-30"
 }
}