Description

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-29T06:17:29.450Z",
  "pubdate": "2026-08-29T06:17:29.450Z",
  "executiveSummary": "The User Profile Builder WordPress plugin prior to version 4.0.1 contains a critical access control vulnerability within its front-end file upload mechanism. This flaw allows unauthenticated remote attackers to bypass authorization checks intended for administrative or privileged roles. By exploiting this misconfiguration, unauthorized entities can perform unauthorized operations, including the enumeration of the site's media library and the unauthorized modification of unpublished content, such as pages, posts, and media files owned by other users. This vulnerability presents a high security risk, as it effectively grants unauthenticated visitors elevated privileges, leading to potential data exposure, content manipulation, and integrity loss. No specific authentication is required to initiate the exploitation, making it a critical threat to WordPress installations utilizing this plugin for front-end management.",
  "technicalDetails": "The vulnerability resides in the front-end file upload functionality provided by the User Profile Builder plugin. The root cause is an improper implementation of authorization logic, specifically failing to validate the session or user privileges when processing requests related to the media library and post-management interfaces. Instead of enforcing strict capability checks (such as 'edit_posts' or 'manage_options'), the plugin incorrectly trusts requests originating from the front-end interface, regardless of the sender's authentication status.\nThe exploitation flow begins when an unauthenticated attacker sends crafted HTTP requests to the exposed file upload or management endpoints. Because the plugin does not verify the user's role before processing these requests, the server-side code proceeds to execute functions associated with administrative or contributor workflows. An attacker can leverage this lack of validation to query the WordPress database for media library contents, potentially revealing sensitive file paths, internal metadata, and previously hidden uploaded assets.\nFurthermore, the vulnerability extends to the manipulation of unpublished content. By sending specially crafted POST or PUT requests to the relevant plugin controllers, an attacker can modify existing unpublished posts or pages. This includes updating content, metadata, and associated media attachments belonging to other site users. This occurs because the internal plugin functions fail to verify object ownership or the current user's authority to modify specific database entities.\nThe affected component is the plugin's front-end integration module, specifically the logic responsible for handling media uploads and content editing tasks. All versions of the User Profile Builder plugin prior to 4.0.1 are confirmed to be vulnerable. Since this interface is accessible via the web front-end, the attack vector is network-based and requires no pre-existing valid account, significantly lowering the barrier to exploitation. Post-exploitation, an attacker can effectively manipulate the integrity of the site's content database and conduct reconnaissance on uploaded assets, which may contain sensitive information."
}