High severity · published Aug 31, 2026
CVE-2026-82607
Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload
7.3
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 3.16.2 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PB
Profile Builder Plugin · Cozmoslabs
3.16.0; 3.16.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82607
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82607
ciphersecuritylabs.com
https://ciphersecuritylabs.com/research/articles/when-the-browser-is-the-only-bouncer-unauthenticated-media-upload-in-profile-builder
vuldb.com
https://vuldb.com/cve/CVE-2026-82607
vuldb.com
https://vuldb.com/submit/892841
vuldb.com
https://vuldb.com/vuln/397108
vuldb.com
https://vuldb.com/vuln/397108/cti
www.cozmoslabs.com
https://www.cozmoslabs.com/docs/profile-builder/free-changelog/