CVE-2026-3717: CWE-862 Missing Authorization in bestwpdeveloper WP CV Builder

CVE-2026-3717 is a missing authorization vulnerability in the WP CV Builder plugin by bestwpdeveloper. The issue exists in the 'wp_save_signature_image' function, which lacks proper capability checks, allowing unauthenticated attackers to upload arbitrary files with a .png extension to the WordPress uploads directory. This vulnerability affects all versions up to and including 1.3.1. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An unauthenticated attacker can upload arbitrary PNG files to the WordPress uploads directory. While the vulnerability does not directly affect confidentiality or availability, it impacts integrity by allowing unauthorized content to be placed on the server. This could potentially be leveraged for further attacks depending on the server configuration and usage of uploaded files.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restricting file upload permissions and implementing additional access controls on the uploads directory may help mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.