Michel Prunet

**Name of the Vulnerable Software and Affected Versions** User Profile Builder WordPress plugin versions prior to 3.11.8 **Description** The issue allows unauthenticated users to upload media files via the async upload functionality of WordPress due to a lack of proper authorization. **Recommendations** For versions prior to 3.11.8, update to version 3.11.8 or later to resolve the issue. As a temporary workaround, consider disabling the async upload functionality until a patch is available. Restrict access to the media upload feature to minimize the risk of exploitation.