The Vulnerability allows authenticated users to bypass reCAPTCHA verification on comment submissions, ignoring an administrator’s anti‑spam configuration. This results in the ability to post spam or potentially malicious content without encountering the expected verification step. The impact is primarily on the integrity and trustworthiness of the comment system, as attackers can flood the site with unwanted posts.

The issue exists in all installations of the Profile Builder WordPress plugin from version 4.0.0 up to and including 4.0.4.

With a CVSS score of 4.3 the vulnerability is considered medium severity. The EPSS score is not available, and the item is not listed in CISA KEV. The most likely attack vector is through any authenticated user, who may directly submit a comment that bypasses the anti‑spam check. No additional exploitation conditions are noted beyond having access to a user account on the site.