Profile Builder WordPress plugin: Privilege escalation via incorrect privilege assignment
Summary
The WordPress plugin Profile Builder by Cozmoslabs up to and including version 4.0.4 contains an incorrect privilege assignment. An attacker with a low-privilege account can become an administrator and gain full control of the website. No user interaction is required, so the risk is highest on sites with open registration or member areas.
Affected
- Profile Builder (WordPress plugin) up to and including 4.0.4
- Paid editions (Basic, Pro, Unlimited): unknown
Fixed in
- Version 4.0.5 is the patched version according to Patchstack.
- Version 4.0.6 is listed on WordPress.org and includes the 4.0.5 fix.
Workaround
- No vendor workaround known.
- If you cannot update, ask your hosting provider or web developer for help. Patchstack has also issued a mitigation rule for its customers.
Exploitation
- Exploited in the wild: not confirmed.
- Patchstack expects exploitation and notes that similar issues are used in mass-exploit campaigns. This is a forecast, not an observed attack.
- VulDB states that no exploit exists. No public proof of concept has been found, but this is unverified.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Update Profile Builder to version 4.0.6 or the latest release now.
- Check for unexpected administrator accounts and review role changes since the plugin was installed.
- Review whether public registration or low-privilege accounts exist and restrict them if not needed.
- Monitor the site for unusual administrative activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB CVE-2026-112242 vuldb.com
- VulDB vulnerability 425227 vuldb.com
- WordPress.org Profile Builder plugin page wordpress.org
- HOL Guard CVE-2026-112242 hol.org
- Vulners CVE-2026-112242 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:01.
Original description (NVD)
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.