CVE-2026-76548

8.2 Élevée

Publiée le 29/08/2026 à 08:17 · Modifiée le 31/08/2026 à 22:14 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

Traduire en français

Produits concernés

Unknown User Profile Builder

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.2 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N`

Faiblesses (CWE)

CWE-287

Références

https://wpscan.com/vulnerability/75e0611d-e11d-44f8-8fc1-7c40bb113f64/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories