{"id":"CVE-2026-112242","kind":"vulnerability","aliases":["CVE-2026-112242"],"related":[],"title":"Profile Builder WordPress plugin: flaw lets users escalate their privileges","description":"Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.","summary":"Profile Builder, a WordPress plugin by Cozmoslabs, has an incorrect privilege assignment flaw that allows privilege escalation. An attacker with a site account could gain higher rights than they should have, such as admin-level access.","severity":"high","cvss":8.8,"epss":0.00232,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","profile-builder","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-above-4.0.4"],"how_to_check":"Check the installed Profile Builder version in the WordPress plugins screen or wp-content/plugins/profile-builder; versions through 4.0.4 are affected.","fix":"Update Profile Builder to a version later than 4.0.4 (the patched version is not named in the sources; unknown).","status":"open","published_at":"2026-10-22T09:17:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:34+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:32:34Z","model":"claude-haiku-5-5","output":{"fix":"Update Profile Builder to a version later than 4.0.4 (the patched version is not named in the sources; unknown).","reach":"internet","title":"Profile Builder WordPress plugin: flaw lets users escalate their privileges","impact":"high","summary":"Profile Builder, a WordPress plugin by Cozmoslabs, has an incorrect privilege assignment flaw that allows privilege escalation. An attacker with a site account could gain higher rights than they should have, such as admin-level access.","category":"package","who_cares":["wordpress","profile-builder","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Low-privileged user gains elevated site rights, possibly administrator","analyst_note":"Confirm the patched version and whether an account is required, via the NVD entry and the vendor changelog.","how_to_check":"Check the installed Profile Builder version in the WordPress plugins screen or wp-content/plugins/profile-builder; versions through 4.0.4 are affected.","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-4.0.4"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000505,"input_tokens":2908,"output_tokens":428,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112242':13A,16A '-2026':12A,15A '4.0.4':83C 'access':61B 'account':47B 'admin':59B 'admin-level':58B 'affect':77C 'allow':39B,73C 'assign':36B,64C 'attack':43B 'builder':2A,20B,26B,69C,72C,79C 'could':48B 'cozmoslab':31B,67C 'cve':11A,14A 'escal':8A,41B 'escalation.this':75C 'flaw':5A,37B 'gain':49B 'higher':50B 'host':23B 'incorrect':34B,62C 'issu':76C 'let':6A 'level':60B 'n/a':81C 'packag':17B 'plugin':4A,29B 'privileg':10A,35B,40B,63C,74C 'profil':1A,19B,25B,68C,71C,78C 'profile-build':18B,70C 'right':51B 'self':22B 'self-host':21B 'site':46B 'user':7A 'vulner':65C 'wordpress':3A,24B,28B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112242","severity":null,"published_at":"2026-10-22T09:17:14+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112242","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112242","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}