Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile… (CVE-2026-112242)

CVE-2026-112242 describes an Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder (profile-builder) that permits privilege escalation. The flaw affects versions from an unspecified initial version through 4.0.4. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that an attacker with low privileges can exploit this remotely without user interaction, resulting in full compromise of confidentiality, integrity, and availability. The weakness is classified under CWE-266 (Incorrect Privilege Assignment). No patch or remediation information is provided in the data.

Successful exploitation allows an attacker with limited privileges to escalate their privileges, potentially gaining full control over the affected system. This can lead to complete compromise of confidentiality, integrity, and availability of the system running the vulnerable Profile Builder plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Profile Builder plugin and monitor for suspicious activity related to privilege escalation attempts.