CVE-2026-111982 User Profile Builder CVE debrief

Who should care

Defenders responsible for WordPress installations with the User Profile Builder plugin, particularly those with Multisite configurations, should assess exposure and prioritize remediation.

Why it matters

The vulnerability in User Profile Builder plugin allows Multisite subsite admins to change emails of other users, including Network Super Admins, potentially leading to account takeover. Defenders should verify and upgrade to version 4.0.5 or later, restrict access to the Edit Profile form, and monitor for suspicious email changes.

• Potential account takeover by Multisite subsite admins
• Elevation of privileges for attackers
• Lateral movement within Multisite networks
• Increased risk of unauthorized access to sensitive areas

Technical summary

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow. This vulnerability allows for potential account takeover and elevation of privileges for attackers, with defenders needing to verify and upgrade to version 4.0.5 or later, restrict access to the Edit Profile form, and monitor for suspicious email changes.

Defensive priority

Defenders should prioritize verifying and upgrading to version 4.0.5 or later of the User Profile Builder plugin, restricting access to the Edit Profile form, and monitoring for suspicious email changes.

Recommended defensive actions

• Verify and upgrade to version 4.0.5 or later of the User Profile Builder plugin
• Restrict access to the Edit Profile form
• Monitor for suspicious email changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or affected versions. Defenders should verify the plugin version, review user roles and access controls, and monitor for suspicious email changes. The vulnerability allows Multisite subsite admins to change emails of other users, including Network Super Admins, potentially leading to account takeover. Evidence from the CVE Program and NVD detail page supports this assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.