{"id":"CVE-2026-111982","kind":"vulnerability","aliases":["CVE-2026-111982"],"related":[],"title":"User Profile Builder WordPress plugin lets subsite admins hijack Super Admin accounts","description":"The User Profile Builder  WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.","summary":"The User Profile Builder WordPress plugin before 4.0.5 does not check that the user editing a profile is allowed to edit the selected account. An Administrator on a Multisite subsite can change another user's email, including a Network Super Admin's, and then reset that password to take over the account.","severity":"high","cvss":7.2,"epss":0.00132,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multisite","package","user-profile-builder","wordpress"],"not_affected_if":["plugin-updated-to-4.0.5","single-site-wordpress"],"how_to_check":"- Check the installed User Profile Builder version in the WordPress admin plugins list or with `wp plugin get profile-builder --field=version`\n- Confirm whether the site runs WordPress Multisite with subsites that have Administrator users","fix":"- Update User Profile Builder to `4.0.5` or later\n- Review Super Admin and other high-privilege accounts for unexpected email changes","status":"open","published_at":"2026-10-23T06:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:27:42+00:00","updated_at":"2026-10-25T03:27:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:27:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update User Profile Builder to `4.0.5` or later\n- Review Super Admin and other high-privilege accounts for unexpected email changes","reach":"internet","title":"User Profile Builder WordPress plugin lets subsite admins hijack Super Admin accounts","impact":"high","summary":"The User Profile Builder WordPress plugin before 4.0.5 does not check that the user editing a profile is allowed to edit the selected account. An Administrator on a Multisite subsite can change another user's email, including a Network Super Admin's, and then reset that password to take over the account.","category":"package","nicknames":[],"who_cares":["wordpress","multisite","user-profile-builder"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over a Network Super Admin account via password reset","analyst_note":"","how_to_check":"- Check the installed User Profile Builder version in the WordPress admin plugins list or with `wp plugin get profile-builder --field=version`\n- Confirm whether the site runs WordPress Multisite with subsites that have Administrator users","needs_analyst":false,"not_affected_if":["plugin-updated-to-4.0.5","single-site-wordpress"],"who_is_affected":"Sites running User Profile Builder before 4.0.5 on a WordPress Multisite network are exposed, because the attack needs a subsite Administrator account. Single-site WordPress installs are not described as affected by the sources, though they should still update the plugin.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00061,"input_tokens":3366,"output_tokens":546,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111982':15A,18A '-2026':14A,17A '4.0.5':33B,85C 'account':12A,49B,77B,98C,121C,133C 'admin':8A,11A,66B,127C 'administr':51B,110C 'allow':44B,108C 'anoth':58B 'author':93C 'builder':3A,24B,29B,81C 'chang':57B,116C 'check':36B 'cve':13A,16A 'edit':40B,46B,95C,105C 'email':61B,122C 'end':104C 'flow':139C 'form':107C 'front':103C 'front-end':102C 'hijack':9A 'includ':62B,123C 'let':6A 'multisit':19B,54B,113C 'network':64B,125C 'packag':20B 'password':72B,137C 'password-reset':136C 'plugin':5A,31B,83C 'profil':2A,23B,28B,42B,80C,106C 'reset':70B,138C 'select':48B,99C 'specif':97C 'subsit':7A,55B,114C 'super':10A,65B,126C 'take':74B,130C 'user':1A,22B,27B,39B,59B,79C,91C,119C 'user-profile-build':21B 'verifi':88C 'wordpress':4A,25B,30B,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running User Profile Builder before 4.0.5 on a WordPress Multisite network are exposed, because the attack needs a subsite Administrator account. Single-site WordPress installs are not described as affected by the sources, though they should still update the plugin.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111982","severity":null,"published_at":"2026-10-23T06:17:06+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111982","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111982","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}