CVE-2026-125776 · Package
NO FIX YET
Profile Builder, a WordPress plugin by Cozmoslabs, has a missing authorization check that lets it be exploited through incorrectly configured access control levels. The sources say versions through 4.0.6 are affected.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Profile Builder through version 4.0.6 that use its access control levels to restrict content. The sources do not say which configurations are exposed, so sites that do not use these access control features may be less at risk. unknown
Not affected if unknown
Who cares profile-builder, wordpress
wp plugin get profile-builder --field=version4.0.6No fix yet, per the sources.
Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.