Live › vulnerability › CVE-2026-111982
Go to dashboardThe User Profile Builder WordPress plugin before 4.0.5 does not check that the user editing a profile is allowed to edit the selected account. An Administrator on a Multisite subsite can change another user's email, including a Network Super Admin's, and then reset that password to take over the account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running User Profile Builder before 4.0.5 on a WordPress Multisite network are exposed, because the attack needs a subsite Administrator account. Single-site WordPress installs are not described as affected by the sources, though they should still update the plugin.
No product ranges from the sources yet.
wp plugin get profile-builder --field=version4.0.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.
This page as .md · .json · in your agent: get_signal("CVE-2026-111982")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.