Unauthenticated Media Upload in Cozmoslabs Profile Builder Plugin
Profile Builder Plugin for WordPress up to 3.16.1 allows unauthenticated file uploads via the avatar AJAX endpoint, bypassing server-side access controls.
- Vendor
- Cozmoslabs
- Product
- Profile Builder Plugin for WordPress
- CVSS
- 7.3
- EPSS (exploit probability)
- 0.5%
- Status
- unpatched
- Published
Is CVE-2026-82607 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-82607 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-21 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-82607 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The wppb_ajax_simple_avatar AJAX handler in Cozmoslabs Profile Builder is registered as a wp_ajax_nopriv_ endpoint, making it reachable by unauthenticated visitors. The plugin enforces upload restrictions only client-side; the server-side handler performs no authentication or nonce check before accepting the upload. Any remote, unauthenticated attacker can submit a POST request to /wp-admin/admin-ajax.php and write attacker-controlled files to the server.
Severity depends on the hosting environment and which file types the handler ultimately permits. Storage abuse is the floor; further exploitation depends on server configuration. All Profile Builder versions up to and including 3.16.1 are affected. Check the plugin’s changelog for a patched release and update immediately.
