PT-2026-26250 · Cozmoslabs · Profile Builder

0Xd4Rk5Id3 · Publicado 2026-03-19 · Atualizado 2026-03-19 · CVE-2026-27413

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cozmoslabs Profile Builder Pro versions through 3.13.9

Description The software contains an Improper Neutralization of Special Elements used in an SQL Command issue, also known as a SQL Injection. This allows for Blind SQL Injection. The issue affects the application and could allow attackers to execute malicious SQL queries. No information is available regarding the number of potentially affected devices or real-world incidents. The vulnerability allows attackers to execute Blind SQL Injection. The vulnerable component is susceptible to exploitation via crafted SQL commands.

Recommendations Update to version 3.14 to address the issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-27413

Produtos afetados

Profile Builder

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-27413 · Nota de Segurança
• https://twitter.com/0dayPublishing/status/2034508695325876244 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2034520902390419547 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2034562551904632995 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2034519128904736982 · Publicação no Twitter
• https://patchstack.com/database/Wordpress/Plugin/profile-builder-pro/vulnerability/wordpress-profile-builder-pro-plugin-3-13-9-sql-injection-vulnerability?_s_id=cve · Nota
• https://twitter.com/CVEnew/status/2034520374268891163 · Publicação no Twitter
• https://patchstack.com/database/wordpress/plugin/profile-builder-pro/vulnerability/wordpress-profile-builder-pro-plugin-3-13-9-sql-injection-vulnerability?_s_id=cve · Nota