CVE-2026-105058: CWE-266 Incorrect Privilege Assignment in John James Jacoby WP User Profiles

This vulnerability, identified as CWE-266 (Incorrect Privilege Assignment), exists in WP User Profiles versions up to 2.7.3. It allows users with subscriber privileges to escalate their access rights, potentially gaining unauthorized administrative capabilities. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no user interaction, resulting in high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected WordPress site by allowing an attacker with subscriber-level access to gain higher privileges, potentially administrative. This can result in unauthorized data access, modification, or deletion, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict subscriber privileges where possible and monitor for suspicious activity related to privilege escalation.