Cozmoslabs Profile Builder: Sensitive data exposure in WordPress plugin
Summary
The WordPress plugin Profile Builder up to and including version 4.0.6 contains a flaw (CWE-201) that causes sensitive information to be included in data sent to the client. According to the CVSS vector, an unauthenticated remote attacker can read this data over the network without user interaction. The exact data exposed and the trigger are not described in the sources available to us, and the vendor changelog has not confirmed the fix yet.
Affected
- Profile Builder (WordPress plugin) from 0 through 4.0.6
- Separate product line 'User Profile Builder' (3.16.x) is not covered by this CVE; verify the installed plugin name and version
Fixed in
- Profile Builder 4.0.7 (per CNA and third-party trackers; not yet confirmed in the vendor changelog)
Workaround
Unknown.
Exploitation
- CISA KEV: No
- Trackers: not known to be exploited
- VulDB: no exploit exists; no public proof of concept found, but the record is new
- Patchstack rates the priority as Low and considers exploitation unlikely
Our recommendation
- Inventory all WordPress sites running Profile Builder and verify the plugin name and version
- Update affected installations to 4.0.7 or later and confirm the version afterwards
- Review which user or profile data is visible to unauthenticated visitors, as personal data may be affected under the nDSG
- Check the Patchstack advisory and the Cozmoslabs 4.0.7 changelog once available
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-125777 www.cve.org
- Patchstack advisory patchstack.com
- VulDB entry 435757 vuldb.com
- OffSeq Radar threat entry radar.offseq.com
- Cozmoslabs free changelog www.cozmoslabs.com
- WordPress.org plugin page en-gb.wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:45.
Original description (NVD)
Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.