Live › vulnerability › CVE-2026-112242
Go to dashboardProfile Builder, a WordPress plugin by Cozmoslabs, has an incorrect privilege assignment flaw that allows privilege escalation. An attacker with a site account could gain higher rights than they should have, such as admin-level access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Profile Builder version in the WordPress plugins screen or wp-content/plugins/profile-builder; versions through 4.0.4 are affected.
Update Profile Builder to a version later than 4.0.4 (the patched version is not named in the sources; unknown).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-112242")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.