The User Profile Builder plugin for WordPress suffers from an insecure direct object reference vulnerability (CWE-639) in the wppb_save_avatar_value() function. This vulnerability allows authenticated users with subscriber or higher privileges to manipulate a user-controlled key without proper validation, enabling them to change the 'post_author' field and thereby reassign ownership of posts and attachments arbitrarily. This issue affects versions up to and including 3.15.5. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. There is no patch or official remediation guidance currently available from the vendor, and no public exploits have been reported.

An authenticated attacker with subscriber-level access or higher can reassign ownership of arbitrary posts and attachments by exploiting the missing validation on a user-controlled key. This could lead to unauthorized modification of content ownership, potentially impacting content integrity and management within the affected WordPress site. There is no indication of confidentiality or availability impact. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user privileges as much as possible and monitor for suspicious activity related to post ownership changes. Avoid granting unnecessary permissions to authenticated users. Follow vendor channels closely for updates and apply patches promptly once available.