HIGH 7.2 NVD

CVE-2026-111982

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Pr

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

References

https://wpscan.com/vulnerability/b7d1fd86-3927-4cf2-88ed-46401e347320/

Published: 2026-10-23 · Source: NVD · Feed updated: 2026-10-23

This high severity vulnerability with a CVSS score of 7.2 was published on 2026-10-23 via NVD.

vulnfeed aggregates 15176 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.