CVE-2026-76548

The User Profile Builder WordPress plugin before 4.0.1 fails to properly restrict its front-end file upload feature, so requests from unauthenticated visitors are not correctly checked against the privileged-role capabilities they should have (CWE-287, improper authentication). An attacker triggers the flaw simply by sending requests to the plugin's front-end upload functionality on an affected site without logging in. This grants the attacker capabilities normally reserved for privileged users: listing the site's media library and modifying unpublished posts, pages, and media items belonging to other users, yielding a low-impact information disclosure with a high-impact integrity change, consistent with the 8.2 CVSS score (C:L/I:H/A:N). Any WordPress site running an affected version of the plugin, particularly where the front-end upload feature is reachable, is affected, and version 4.0.1 contains the fix. No public proof-of-concept is known, the flaw is not listed in CISA's KEV, and its EPSS of 0.2% (8th percentile) indicates a low likelihood of exploitation in the next 30 days.

What to do: Update User Profile Builder to version 4.0.1 or later. If you cannot update immediately, disable or restrict the plugin's front-end file upload capability, for example by limiting access to the upload endpoint via a WAF or firewall rule, until you can patch. After patching, review unpublished posts, pages, and the media library for unauthorized changes made by anonymous visitors.