WordPress Plugin Vulnerabilities

Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass

Description

The plugin does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.

Proof of Concept

Affects Plugins

Plugin icon
profile-builder
Fixed in 4.0.5

References

CVE
CVE-2026-111965

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
81175472-a748-4ba6-9c9e-7b08adb652fc

Timeline

Publicly Published
2026-10-21 (about 2 days ago)
Added
2026-10-21 (about 1 day ago)
Last Updated
2026-10-21 (about 1 day ago)

Other

Published
Title
Published
2020-02-10
Title
Profile Builder and Profile Builder Pro < 3.1.1 - User Registration With Administrator Role
Published
2018-11-08
Title
WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option
Published
2026-09-24
Title
All-In-One Security (AIOS) < 5.4.9 - Subscriber+ Security Control Bypass via udrpc_action Format Parameter
Published
2015-07-18
Title
WordPress Mobile Pack <= 2.1.2 - Information Disclosure
Published
2014-08-01
Title
Captcha 2.12-3.8.1 - Captcha Bypass