Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb_save_avatar_value() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to reassign ownership of arbitrary posts and attachments by changing 'post_author'.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-31 | 2 | Disclosure2 |
| 2026-04-01 | 1 | PoC1 |
CVE-2026-3139 The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in… https://www.cve.org/CVERecord?id=CVE-2026-3139
Post summary
The statement announces CVE-2026-3139, noting an Insecure Direct Object Reference flaw in the User Profile Builder WordPress plugin, and directs readers to the official CVE record for details.
https://atomicedge.io/cve-proof/cve-2026-3139-profile-builder-version-3-15-5-medium-vulnerability-proof-of-concept CVE-2026-3139 #WordPress plugin #vulnerability profile-builder#cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof‑of‑concept for CVE-2026-3139 targeting the WordPress Profile Builder plugin is linked; no evidence of active exploitation, patches, or detailed exploit code is provided.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3139 - User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Aut… https://ift.tt/XBzoiw7
Post summary
The alert announces CVE‑2026‑3139, a vulnerability in User Profile Builder versions ≤3.15.5 involving an insecure direct object reference for authenticated subscribers, but it does not include exploitation code, patch info, or evidence of active attacks.