{"id":"CVE-2026-54853","kind":"vulnerability","aliases":["CVE-2026-54853"],"related":[],"title":"Profile Builder WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.","summary":"Profile Builder, a WordPress plugin by Cozmoslabs, has a missing authorization check that lets access control settings be exploited through incorrect configuration. The sources say it affects versions through 4.0.5 and rate it medium (CVSS 5.3).","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cozmoslabs","package","profile-builder","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Profile Builder plugin version in the WordPress admin under Plugins.\n- Compare the version against `4.0.5`; the sources say versions through `4.0.5` are affected.","fix":null,"status":"open","published_at":"2026-10-29T15:17:23+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","triaged_at":"2026-10-29T15:26:51+00:00","updated_at":"2026-10-29T15:26:51+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:26:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Profile Builder WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"Profile Builder, a WordPress plugin by Cozmoslabs, has a missing authorization check that lets access control settings be exploited through incorrect configuration. The sources say it affects versions through 4.0.5 and rate it medium (CVSS 5.3).","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","profile-builder","cozmoslabs"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may bypass access control restrictions on the site","analyst_note":"Find the vendor advisory or the Wordfence/WPScan entry to confirm the exact vulnerable feature, required privileges and fixed version.","how_to_check":"- Check the installed Profile Builder plugin version in the WordPress admin under Plugins.\n- Compare the version against `4.0.5`; the sources say versions through `4.0.5` are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Profile Builder WordPress plugin up to and including version 4.0.5, particularly those using its access control and user role features. The sources do not describe the exact configuration needed to trigger it. Sites not running the plugin, or running a newer version, are not affected according to the stated range.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4116,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54853':13A,16A '4.0.5':52B,84C '5.3':58B 'access':9A,37B,73C 'affect':49B,78C 'allow':69C 'author':6A,33B,60C 'builder':2A,21B,24B,65C,68C,80C 'check':7A,34B 'configur':44B,72C 'control':10A,38B,74C 'cozmoslab':17B,29B,63C 'cve':11A,14A 'cvss':57B 'exploit':41B,70C 'expos':8A 'incorrect':43B,71C 'issu':77C 'let':36B 'levels.this':76C 'medium':56B 'miss':5A,32B,59C 'n/a':82C 'packag':18B 'plugin':4A,27B 'profil':1A,20B,23B,64C,67C,79C 'profile-build':19B,66C 'rate':54B 'say':47B 'secur':75C 'set':39B 'sourc':46B 'version':50B 'vulner':61C 'wordpress':3A,22B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Profile Builder WordPress plugin up to and including version 4.0.5, particularly those using its access control and user role features. The sources do not describe the exact configuration needed to trigger it. Sites not running the plugin, or running a newer version, are not affected according to the stated range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54853","severity":null,"published_at":"2026-10-29T15:17:23+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","fetched_at":"2026-10-29T15:25:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}