A flaw in the Cozmoslabs Profile Builder plugin incorrectly assigns privilege levels, enabling an attacker who can exploit the plugin to elevate their rights within a WordPress site. This vulnerability can let a user gain higher role permissions or modify other users, compromising the integrity of the platform and potentially giving the attacker administrative access. The vulnerability exists in all releases up through 4.0.4, including the initial releases where this flaw was introduced.

WordPress installations that use the Cozmoslabs Profile Builder plugin, versions n/a through 4.0.4. The fix is available in version 4.0.5 and later.

The CVSS score of 8.8 classifies this as a high‐severity issue. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the statistical likelihood of exploitation is currently unknown, but the high severity and ability to elevate privileges suggest a strong motivation for attackers. The attack vector is likely through the web application, requiring that the attacker obtain an authenticated session or otherwise manipulate the plugin’s role assignment logic. Successful exploitation would grant the attacker unauthorized administrative privileges and potentially full control over the WordPress site.