{"id":"CVE-2026-111982","published":"2026-10-23T06:17:06.097","lastModified":"2026-10-23T14:20:57.920","description":"The User Profile Builder  WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.","cvssScore":7.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/b7d1fd86-3927-4cf2-88ed-46401e347320/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}