Description

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 3.16.2 is sufficient to resolve this issue. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T03:16:43.103Z",
  "pubdate": "2026-08-31T03:16:43.103Z",
  "executiveSummary": "A critical security vulnerability identified in the Cozmoslabs Profile Builder WordPress plugin allows for unrestricted file uploads. The vulnerability exists within the Avatar Simple Upload AJAX Handler, specifically in the wppb_ajax_simple_avatar function. By bypassing security controls, a remote attacker can upload arbitrary files to the WordPress environment.\nThe vulnerability is classified as an Unrestricted Upload of File with Dangerous Type. Successful exploitation could lead to Remote Code Execution (RCE) if the attacker uploads executable scripts, such as PHP shells, to a web-accessible directory. This poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site.\nThe attack is remotely exploitable and does not explicitly require high-level administrative privileges, significantly lowering the barrier for entry. Publicly available exploit code increases the likelihood of active exploitation. This vulnerability affects all versions of the Profile Builder plugin up to and including 3.16.1. Immediate patching to version 3.16.2 or later is required to mitigate this risk.",
  "technicalDetails": "The vulnerability resides in the wppb_ajax_simple_avatar function located within /wp-admin/admin-ajax.php, which serves as the AJAX handler for the Avatar Simple Upload functionality. The core issue stems from insufficient input validation and file type enforcement mechanisms during the file upload process. The application fails to adequately verify the MIME type, file extension, or content structure of uploaded files before storing them on the server filesystem.\nAn attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the admin-ajax.php endpoint. By manipulating the request parameters associated with the avatar upload functionality, the attacker can force the application to accept and save a malicious file—such as a PHP script designed for remote command execution—into a publicly accessible directory. Because the application does not implement strict sanitization or a whitelist-based validation process, the uploaded script is subsequently accessible via a direct URL.\nThe attack flow proceeds as follows: First, the attacker identifies the target endpoint (/wp-admin/admin-ajax.php) and the required action identifier for the avatar upload. Second, the attacker constructs a multipart/form-data request containing the malicious file, disguised as an avatar. Third, the wppb_ajax_simple_avatar function processes the request without sufficient inspection, storing the malicious file in the designated upload directory. Finally, the attacker triggers the execution of the uploaded script by requesting its direct URL via a web browser or automated tool, resulting in arbitrary code execution within the context of the web server.\nThis vulnerability is particularly dangerous because it allows attackers to achieve persistence and full control over the compromised WordPress instance. Once arbitrary code execution is established, the attacker can leverage the compromised server to further internal reconnaissance, manipulate database contents, deface the website, or pivot to other network segments. The lack of robust file validation mechanisms effectively renders the server environment vulnerable to complete compromise. Given that the exploit is publicly documented, systems running versions prior to 3.16.2 are at immediate risk of exploitation by automated bots and targeted attackers alike."
}