Unauthenticated Media Upload in Cozmoslabs Profile Builder Plugin
Profile Builder Plugin for WordPress up to 3.16.1 allows unauthenticated file uploads via the avatar AJAX endpoint, bypassing server-side access controls.
- Vendor
- Cozmoslabs
- Product
- Profile Builder Plugin for WordPress
- CVSS
- 7.3
- EPSS (exploit probability)
- 0.3%
- Status
- unpatched
- Published
The wppb_ajax_simple_avatar AJAX handler in Cozmoslabs Profile Builder is registered as a wp_ajax_nopriv_ endpoint, making it reachable by unauthenticated visitors. The plugin enforces upload restrictions only client-side; the server-side handler performs no authentication or nonce check before accepting the upload. Any remote, unauthenticated attacker can submit a POST request to /wp-admin/admin-ajax.php and write attacker-controlled files to the server.
Severity depends on the hosting environment and which file types the handler ultimately permits. Storage abuse is the floor; further exploitation depends on server configuration. All Profile Builder versions up to and including 3.16.1 are affected. Check the plugin’s changelog for a patched release and update immediately.
