The User Profile Builder plugin for WordPress is vulnerable to an Insecure Direct Object Reference that allows an authenticated account with subscriber-level or higher privileges to change the post_author attribute of any post or attachment by submitting a crafted avatar value. This flaw enables the attacker to reassign ownership of arbitrary content, effectively escalating privileges within the site and compromising the integrity of posts and media.

The vulnerability affects the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin from Cozmos Labs. All releases up to and including version 3.15.5 are impacted. The plugin is distributed as a WordPress plugin.

The CVSS score of 4.3 indicates a moderate severity. Because the flaw is exploitable only by logged‑in users with subscriber access or higher, the surface is larger than an unmapped vulnerability but still requires authenticated credentials. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to make a request to the avatar upload flow, supplying a malicious post_author value; no arbitrary code execution is possible. The risk is practical for sites with many subscribers who can potentially hijack content.