CVE-2026-111965 Profile Builder CVE debrief

Who should care

WordPress administrators and security teams responsible for maintaining and securing WordPress installations with the Profile Builder plugin should assess their exposure and apply necessary patches.

Why it matters

CVE-2026-111965 is a medium-severity vulnerability in the Profile Builder WordPress plugin that allows authenticated users to bypass reCAPTCHA verification on comment submission paths. WordPress administrators and security teams should assess exposure, verify reCAPTCHA configuration, and apply patches to prevent potential spam injection and bypass of anti-spam protections.

• Potential spam injection through comment forms.
• Bypass of anti-spam protection mechanisms.
• Possible impact on site integrity and user trust.
• Verification of reCAPTCHA configuration and effectiveness.

Technical summary

The Profile Builder WordPress plugin, versions 4.0.0 to 4.0.4, does not enforce reCAPTCHA verification on all comment submission paths. This allows authenticated users, specifically those with Subscriber+ role, to bypass the anti-spam protection configured for the WordPress comment form. The vulnerability enables potential spam injection and bypass of anti-spam protections. WPScan reported this issue, and the CVE Program and NVD have recorded it based on this report. Defenders should focus on verifying reCAPTCHA configuration and applying patches.

Defensive priority

Medium priority for WordPress administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the installed version of Profile Builder is within the affected range (4.0.0 to 4.0.4).
• Verify if reCAPTCHA is configured and enforced on comment forms.
• Apply the patch by updating Profile Builder to version 4.0.5 or later.
• Monitor comment submissions for potential abuse.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE Program and NVD have recorded this vulnerability based on the WPScan report. The affected versions are confirmed as 4.0.0 to 4.0.4, with the fix in version 4.0.5. Defenders should verify the installed version of Profile Builder and confirm reCAPTCHA configuration and enforcement on comment forms. Evidence is limited to public CVE details and WPScan report.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.