Security Alert Summary
The User Profile Builder plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in the wppb_save_avatar_value() function that allows authenticated users with subscriber-level access and above to reassign ownership of arbitrary posts and attachments by changing the post_author value.
CVE Details
- CVE ID: CVE-2026-3139
- Affected component: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress
- Affected versions: versions up to, and including, 3.15.5
- Published: March 31, 2026 at 12:16:31 PM
- Last modified: March 31, 2026 at 12:16:31 PM
- CVSS v3.1: Base score 4.3 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / Interaction: Authenticated user required (subscriber-level access or higher as noted in the description); Privileges Required: LOW; User Interaction: NONE
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- Weakness: CWE-639 (Insecure Direct Object Reference)
Technical Details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the wppb_save_avatar_value() function caused by missing validation on a user-controlled key. Because the plugin does not properly validate that the user-supplied key may only affect the requesting user’s data, an authenticated attacker with low-level privileges can modify a key that controls the post_author field. By changing post_author, the attacker can reassign ownership of posts and attachments to arbitrary users.
The issue exists because the function accepts and processes a user-controlled value without sufficient authorization checks to ensure the requester is permitted to change the targeted object ownership. The description specifically identifies the wppb_save_avatar_value() function and the lack of validation on the user-controlled key as the root cause.
How This Could Impact Your Website
On a multi-author WordPress site, an attacker with a subscriber account could reassign posts or media attachments from one user to another. In a realistic scenario:
- The site owner maintains published articles and internal staff maintain drafts and attachments.
- An external contributor or a low-privilege account is used to exploit the missing validation and change the
post_authoron select posts or attachments. - As a result, content attribution may be altered, audit trails can be confused, and internal content ownership records may become unreliable. These integrity changes can complicate content management and accountability.
This vulnerability does not indicate direct disclosure of confidential data (the CVSS confidentiality impact is NONE), but it does affect content integrity and could be leveraged as part of broader social engineering or trust-based attacks. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and subscribers.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and audit logs for unusual changes to post authorship or media ownership.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
