The CV Builder – Professional Resume Builder SaaS plugin for WordPress contains a missing capability check on the wp_save_signature_image function in all versions up to and including 1.3.1. This flaw permits unauthenticated attackers to upload arbitrary data as PNG files to the WordPress uploads directory. Because the vulnerability stems from a missing authorization check (CWE‑862), an attacker can create or replace files without needing to authenticate to the site.

Affected systems are installations of the WP CV Builder plugin from the vendor bestwpdeveloper with versions 1..1 or earlier. The plugin is used as a WordPress SaaS to allow users to build professional resumes, and, in these versions, the upload mechanism is exposed to all visitors.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw from the public internet by sending a crafted POST request to the wp_save_signature_image endpoint; no authentication is required. If a malicious PNG containing embedded code or payloads is uploaded, the attacker may achieve persistence or further exploitation of the WordPress site, potentially compromising confidentiality, integrity, or availability.