# User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Authenticated (Author+) Open Redirect via Content Restriction Custom Redirect URL

- **ID:** WPSEC-2026-2006
- **Plugin:** User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (`profile-builder`), https://wordpress.org/plugins/profile-builder/
- **Affected versions:** all versions before 4.0.6
- **Fixed in:** 4.0.6 (Update to 4.0.6 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-601
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/profile-builder
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2006/

## Description

The User Profile Builder plugin for WordPress is vulnerable to Open Redirect via the content restriction custom redirect URL in all versions up to, and including, 4.0.5, due to the URL being stored with only esc_url_raw() and passed to wp_redirect() without host validation. This makes it possible for authenticated attackers with author-level access and above to make their restricted posts redirect visitors to an arbitrary external site.

## References

- https://wpsec.com/vuln/WPSEC-2026-2006/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.6/
- https://wordpress.org/plugins/profile-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2006/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.