Affected is the Avatar Simple Upload AJAX handler in Cozmoslabs Profile Builder Plugin, version 3.16.1 and earlier. An attacker can send a crafted request to the wppb_ajax_simple_avatar action in the admin-ajax.php endpoint and upload an arbitrary file because the plugin does not enforce proper authentication or file type validation. This flaw maps to CWE-284 Authorization and CWE-434 Unrestricted Upload.

The vulnerability exists in WordPress sites that have the Cozmoslabs Profile Builder Plugin installed at 3.16.1 or older. The affected component is the wppb_ajax_simple_avatar function within the plugin. Updating to version 3.16.2 removes the flaw, as the vendor has patched the upload handling logic.

The CVSS score of 6.9 indicates medium severity; the EPSS score is unavailable, and the flaw is not currently listed in the CISA KEV catalog. Because the upload endpoint is publicly accessible, an attacker can perform the exploit remotely without authentication, raising the risk of arbitrary code execution or file-based attacks. The flaw is likely to be exploited through automated scripts that POST files to the admin-ajax.php endpoint.