The vulnerability resides in User Profile Builder before 4.0.5, where the front‑end Edit Profile form fails to confirm that the user has the right to modify the chosen account. This missing authorization check lets a multisite site administrator alter another user’s email address, including that of a Network Super Admin. Once the email is changed, the attacker can trigger a password‑reset email and regain control of the target account. The flaw is a classic lack of proper access control, aligning with CWE‑284 and CWE‑639.

The issue affects the User Profile Builder WordPress plugin for any installation running a version older than 4.0.5. Both single‑site and multisite WordPress environments that rely on the plugin for profile editing are vulnerable. The plugin is listed by the CNA as 'User Profile Builder', and the vulnerability is proportional to sites that enable the Edit Profile feature.

Without patching, the exploit requires only that an attacker be an administrator on a multisite subsite and have access to the site’s front‑end edit page. By exploiting the unchecked email modification, the attacker can hijack an account with Network Super Admin privileges, effectively gaining network‑wide control. The lack of a CVSS score or EPSS data does not reduce the inherent risk, and the vulnerability is not currently listed in the CISA KEV catalog, but the potential impact remains high. Immediate remediation is strongly advised.