What is CVE-2026-111982?

CVE-2026-111982 is a high-severity vulnerability in User Profile Builder, classified under Improper Privilege Management. CVSS score: 7.2/10. Published 2026-10-23.

How severe is CVE-2026-111982?

High severity. CVSS v3 base score is 7.2 out of 10.

Privilege escalation in User Profile Builder

CVE-2026-111982

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

Vulnerability class: Privilege Escalation

Published 2026-10-23 · last modified 2026-10-23.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

User Profile Builder

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

wpscan.com/vulnerability/b7d1fd86-3927-4cf2-88ed-46401e347320/ (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-111982?: CVE-2026-111982 is a high-severity vulnerability in User Profile Builder, classified under Improper Privilege Management. CVSS score: 7.2/10. Published 2026-10-23.
How severe is CVE-2026-111982?: High severity. CVSS v3 base score is 7.2 out of 10.