Live › vulnerability › CVE-2026-54853
Profile Builder, a WordPress plugin by Cozmoslabs, has a missing authorization check that lets access control settings be exploited through incorrect configuration. The sources say it affects versions through 4.0.5 and rate it medium (CVSS 5.3).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the Profile Builder WordPress plugin up to and including version 4.0.5, particularly those using its access control and user role features. The sources do not describe the exact configuration needed to trigger it. Sites not running the plugin, or running a newer version, are not affected according to the stated range.
No product ranges from the sources yet.
4.0.5; the sources say versions through 4.0.5 are affected.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-54853")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.