WordPress User Profile Builder Authorization Bypass Flaw

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The User Profile Builder WordPress plugin before version 4.0.5 contains a critical authorization bypass vulnerability that allows Multisite subsite administrators to modify user accounts they should not have access to. Specifically, attackers can change email addresses for any user on the network, including Super Admins, and then leverage the password reset mechanism to gain account takeover. This vulnerability is particularly dangerous in WordPress Multisite environments where role-based access controls are meant to create security boundaries between administrative domains. Any organization running this plugin with Multisite enabled and delegated subsite administration faces immediate risk of privilege escalation and account compromise.

Casky.ai's 224 mapped security skills detect this vulnerability pattern through MITRE ATT&CK technique TA0004 (Privilege Escalation), leveraging Claude AI's extended reasoning to identify the authorization logic flaws. Practitioners using Casky would observe findings related to improper access control checks on account modification endpoints, missing permission validation before email changes, and suspicious password reset chains originating from unauthorized profile edits. The platform's skill-based detection would flag the absence of nonce verification or capability checks that should prevent cross-user modifications, revealing the exact attack vector before exploitation occurs in production environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-111982.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-111982

Casky has 224 skills that investigate the attack patterns behind CVE-2026-111982. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn