PT-2026-26250 · Cozmoslabs · Profile Builder

0Xd4Rk5Id3 · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-27413

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cozmoslabs Profile Builder Pro versions through 3.13.9

Description The software contains an Improper Neutralization of Special Elements used in an SQL Command issue, also known as a SQL Injection. This allows for Blind SQL Injection. The issue affects the application and could allow attackers to execute malicious SQL queries. No information is available regarding the number of potentially affected devices or real-world incidents. The vulnerability allows attackers to execute Blind SQL Injection. The vulnerable component is susceptible to exploitation via crafted SQL commands.

Recommendations Update to version 3.14 to address the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-27413

Affected Products

Profile Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-27413 · Security Note
• https://twitter.com/0dayPublishing/status/2034508695325876244 · Twitter Post
• https://twitter.com/CveFindCom/status/2034520902390419547 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034562551904632995 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034519128904736982 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/profile-builder-pro/vulnerability/wordpress-profile-builder-pro-plugin-3-13-9-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2034520374268891163 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/profile-builder-pro/vulnerability/wordpress-profile-builder-pro-plugin-3-13-9-sql-injection-vulnerability?_s_id=cve · Note