Profile Builder WordPress plugin: Broken access control
Summary
The Profile Builder WordPress plugin up to and including version 4.0.6 contains a missing authorization flaw (CWE-862) that allows users to access pages or perform actions they should not be allowed to. The exploit requires no authentication and the impact is rated as low confidentiality impact only. The affected function and the exposed data are not described in the available sources.
Affected
- Profile Builder WordPress plugin, versions 0 through 4.0.6
- Note: version numbering differs between sources; check the installed version on the site
Fixed in
- Update to version 4.0.7 or later (per CNA record and Patchstack; vendor confirmation not found)
Workaround
Unknown. No vendor-published workaround was found. Until the update is applied, limit user registration and review user roles and plugin settings.
Exploitation
- Not known to be exploited (one aggregator; no CISA KEV entry found)
- CISA SSVC: Automatable yes, Technical Impact partial, Exploitation none
- Public proof of concept: Unknown
Our recommendation
- Check whether the Profile Builder plugin is installed and which version is active.
- Update to version 4.0.7 or later in the next maintenance window, sooner for internet-facing sites.
- If the site runs 4.0.5 or earlier, also apply the fix for CVE-2026-54853 by updating to the latest version.
- Review user roles and registration settings after the update and monitor logs for unusual access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CNA: Patchstack) www.cve.org
- Patchstack advisory (linked from CVE) patchstack.com
- OffSeq CVE page radar.offseq.com
- Strix CVE page www.strix.ai
- Cozmoslabs free changelog www.cozmoslabs.com
- Patchstack plugin overview patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:38.
Original description (NVD)
Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.