CVE-2026-82607CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2026-82607

High · published August 31, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 3.16.2 is sufficient to resolve this issue. It is suggested to upgrade the affected component.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00495 · 41.5th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-08-31T07:16Z
References (6)
https://ciphersecuritylabs.com/research/articles/when-the-browser-is-the-only-bouncer-unauthenticated-media-upload-in-profile-builder · [email protected]https://vuldb.com/cve/CVE-2026-82607 · [email protected]https://vuldb.com/submit/892841 · [email protected]https://vuldb.com/vuln/397108 · [email protected]https://vuldb.com/vuln/397108/cti · [email protected]https://www.cozmoslabs.com/docs/profile-builder/free-changelog/ · [email protected]
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 31 AUG 02:30Z
    Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload
    cvelistv5