CVE-2026-111965
CVE-2026-111965 · Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
CVSS 4.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
profile builder
- Versions
- ≥ 4.0.0, < 4.0.5: Affected (semver)
Update to 4.0.5