CVE-2026-76547

MediumCVSS 6.6/10Last modified Aug 31, 2026

Description

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the User Profile Builder WordPress plugin before 4.0.1 itself, so further impact requires a suitable gadget from another installed User Profile Builder WordPress plugin before 4.0.1 or .

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
UnknownUser Profile Builder>= 3.3.4, < 4.0.1

References

Timeline

Published
Aug 29, 2026
Last modified
Aug 31, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-765488.2The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticatCVE-2026-765495.9The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actioCVE-2026-76558.1The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This iCVE-2026-765507.2The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing uCVE-2026-765517.2The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowCVE-2026-765528.8The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-CVE-2026-765536.5The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively dCVE-2026-765547.2The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify usCVE-2026-765556.8The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into aCVE-2026-765566.8The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them iCVE-2026-765576.8The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before usingCVE-2026-765586.8The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting the