Profile Builder Plugin Flaw Allows Unauth File Upload

The Cozmoslabs Profile Builder plugin for WordPress has a high-severity unauthenticated file upload flaw, assigned CVE-2026-82607 at CVSS 7.3. All versions up to and including 3.16.1 are affected. The finding was published by Cipher Security Labs, whose report is titled “When the Browser Is the Only Bouncer,” a description that captures the problem precisely.

What’s broken

The vulnerability sits in the wppb_ajax_simple_avatar AJAX handler registered at /wp-admin/admin-ajax.php. WordPress allows plugin authors to register AJAX actions in two ways: wp_ajax_* for authenticated users only, and wp_ajax_nopriv_* for anyone, logged in or not. Profile Builder’s avatar upload endpoint lands in the second category. The plugin validates file uploads on the client side but does not replicate those checks server-side, and the handler accepts requests without confirming the caller is logged in. Any unauthenticated visitor can POST to that endpoint and write files to the server.

What it means

The immediate effect is unauthorized file write access to the web server. The damage ceiling from there depends on the hosting environment: server configuration, uploaded-files directory permissions, and whether the handler enforces strict MIME type validation on the server. Storage exhaustion is the low end. In environments where the upload directory is web-accessible and the server executes certain file types, the risk is higher. Cipher Security Labs notes the class of vulnerability clearly; readers who want the full technical breakdown should consult their advisory directly.

What to do

Update first. Check the Profile Builder plugin page and its changelog for a version that patches CVE-2026-82607. Update immediately; this is not a “schedule it this week” item.

If no patch is available yet, take these interim steps:

• Disable user avatar uploads in Profile Builder’s settings until a fix lands.
• Add a WAF or Nginx/Apache rule blocking unauthenticated POST requests to admin-ajax.php with the wppb_ajax_simple_avatar action parameter.
• Audit your WordPress uploads directory for unexpected files, particularly in subdirectories created by Profile Builder.

Priority call: High. Unauthenticated file upload flaws in WordPress plugins are a standard first step for opportunistic attackers running automated scans. They do not require any user interaction, and they do not require the attacker to know anything about your site beyond that it runs the vulnerable plugin version. Do not let this sit.

Context

WordPress plugin file upload vulnerabilities have been a recurring pattern in 2026. Earlier this month, an unauthenticated upload flaw in MaxUpload for WordPress (CVE-2026-15965) followed a similar pattern: AJAX handler, no auth check, attacker-controlled file write. The miniOrange SAML plugin flaws and Avada theme RCE earlier this month showed that attackers prioritize WordPress targets precisely because the install base is so large and patching often lags behind disclosure.

If you are running Profile Builder, treat this as urgent.