CVE-2026-111982 in User Profile Builder Plugin
Summary
by MITRE • 10/23/2026
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in User Profile Builder versions prior to 4.0.5 represents a critical failure in access control mechanisms within WordPress Multisite environments. This flaw specifically targets the front-end Edit Profile functionality, where the application fails to validate whether the currently authenticated user possesses the necessary permissions to modify the account associated with the request. In standard web application security principles, this is classified as an insecure direct object reference or a broken access control issue, aligning closely with CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key. The core technical deficiency lies in the server-side logic that processes profile update requests; it accepts user-supplied identifiers for the account being edited without cross-referencing them against the permissions of the authenticated session initiating the request.
In a WordPress Multisite architecture, privileges are stratified between network-level administrators and subsite-level administrators. A subsite administrator typically holds elevated rights within their specific site but lacks authority over other sites or users at the network level. However, due to this vulnerability, an attacker with Administrator access to any single subsite can bypass these boundaries. By manipulating the parameters sent during a profile update operation on the front-end interface, the attacker can specify the user ID of another account, including that of a Network Super Admin who holds the highest privileges across the entire WordPress network. This effectively neutralizes the security model designed by Multisite to isolate administrative domains and restrict privilege escalation paths.
The operational impact of this vulnerability is severe because it facilitates complete account takeover through standard recovery mechanisms. Once an attacker successfully modifies the email address associated with a target user's profile, they gain control over the primary communication channel for that account. By initiating a password reset process using the newly controlled email address, the attacker can set a new password and subsequently log in as the victim. This is particularly dangerous when targeting Network Super Admins, as gaining access to such an account provides unrestricted administrative capabilities across all sites within the network. The attacker could then install malicious plugins, exfiltrate sensitive data from any site on the network, or further compromise underlying server infrastructure, leading to a total breach of the WordPress ecosystem's integrity and confidentiality.
From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability maps directly to T1078 Valid Accounts, specifically the technique of utilizing legitimate credentials obtained through unauthorized access. The initial exploitation involves privilege escalation via broken object level authorization, allowing an actor with lower privileges to perform actions reserved for higher-privileged roles. This aligns with common attack patterns observed in content management systems where input validation and permission checks are inconsistently applied across different endpoints or user interfaces.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Administrators running WordPress Multisite installations should upgrade User Profile Builder to version 4.0.5 or later, which implements proper authorization checks ensuring that users can only edit their own profiles unless explicitly granted broader permissions by network administrators. In addition to patching, organizations should enforce strict role-based access control policies and monitor for anomalous profile modification activities, particularly those involving changes to email addresses of high-privilege accounts. Implementing multi-factor authentication adds an additional layer of security that can mitigate the impact even if account credentials are compromised through this vector. Regular auditing of user permissions and limiting the number of users with subsite administrator privileges further reduces the attack surface available for exploitation.