What is GHSA-qgfq-45qj-365w?

GHSA-qgfq-45qj-365w is a security advisory published by GitHub Security Advisories with High severity. The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized...

Which CVE IDs does GHSA-qgfq-45qj-365w cover?

GHSA-qgfq-45qj-365w covers the following CVE IDs: CVE-2026-111982. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qgfq-45qj-365w?

GHSA-qgfq-45qj-365w has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-qgfq-45qj-365wHighCVSS 7.2

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized...

Vendor

GitHub Security Advisories

Published

October 23, 2026

Last Modified

October 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-111982 →

📋 Description

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-111982
https://wpscan.com/vulnerability/b7d1fd86-3927-4cf2-88ed-46401e347320
https://github.com/advisories/GHSA-qgfq-45qj-365w