---
id: "CVE-2026-111982"
kind: "vulnerability"
aliases: ["CVE-2026-111982"]
title: "User Profile Builder WordPress plugin lets subsite admins hijack Super Admin accounts"
severity: "high"
cvss: 7.2
epss: 0.00132
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multisite", "package", "user-profile-builder", "wordpress"]
not_affected_if: ["plugin-updated-to-4.0.5", "single-site-wordpress"]
published_at: "2026-10-23T06:17:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:27:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111982", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111982", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# User Profile Builder WordPress plugin lets subsite admins hijack Super Admin accounts

The User Profile Builder WordPress plugin before 4.0.5 does not check that the user editing a profile is allowed to edit the selected account. An Administrator on a Multisite subsite can change another user's email, including a Network Super Admin's, and then reset that password to take over the account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed User Profile Builder version in the WordPress admin plugins list or with `wp plugin get profile-builder --field=version`
- Confirm whether the site runs WordPress Multisite with subsites that have Administrator users

## Fix

- Update User Profile Builder to `4.0.5` or later
- Review Super Admin and other high-privilege accounts for unexpected email changes

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111982
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111982

## From the sources

The User Profile Builder  WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_