The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated… (CVE-2026-76548)
Description
The User Profile Builder WordPress plugin versions before 4.0.1 contain a vulnerability that improperly restricts front-end file upload functionality. This flaw allows unauthenticated users to perform actions normally reserved for privileged roles, including listing the site's media library and modifying unpublished posts, pages, and media items owned by other users.
CVSS v3.1
Score 8.2high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76548 affects the User Profile Builder WordPress plugin prior to version 4.0.1. The vulnerability arises from insufficient access control on the front-end file upload feature, enabling unauthenticated visitors to access and modify restricted content such as the media library and unpublished content belonging to other users. This represents a privilege escalation issue due to improper authorization checks.
Potential Impact
An attacker without authentication can list media files and modify unpublished posts, pages, and media items of other users. This can lead to unauthorized content manipulation and potential information disclosure. The CVSS score of 8.2 (high severity) reflects the ease of exploitation (network vector, no privileges required, no user interaction) and significant impact on integrity and limited impact on confidentiality.
Mitigation Recommendations
A fix is available in User Profile Builder version 4.0.1. Users should upgrade to version 4.0.1 or later to remediate this vulnerability. No other mitigation steps are indicated or required according to the available data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mpcm-vcpj-wm9p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-76548"]
Threat ID: 6a92f7d3acd9273b49e75903
Added to database: 08/29/2026, 15:16:35 UTC
Last enriched: 09/08/2026, 02:37:28 UTC
Last updated: 10/11/2026, 18:48:22 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.