CVE-2026-111965— Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass
Quick assessment
Affected
Unknown Profile Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Profile Builder WordPress 插件在 4.0.0 至 4.0.4 版本中，未在所有评论提交路径上强制执行 reCAPTCHA 验证，导致已认证用户可以绕过管理员为 WordPress 评论表单配置的防垃圾信息保护机制。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Profile Builder | 4.0.0< 4.0.5 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111965
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Profile Builder | 4.0.0 ~ 4.0.5 | - |
|
II. Public POCs for CVE-2026-111965
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111965
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-23 · 22 CVEs total
| CVE-2026-94263 | 4.8 MEDIUM | Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode E |
| CVE-2026-113472 | Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload | |
| CVE-2026-110537 | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via | |
| CVE-2026-110510 | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and P | |
| CVE-2026-109935 | Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API | |
| CVE-2026-109933 | Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes | |
| CVE-2026-109934 | Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API | |
| CVE-2026-109936 | Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter | |
| CVE-2026-111737 | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists | |
| CVE-2026-111738 | Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option | |
| CVE-2026-111966 | Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute | |
| CVE-2026-111982 | Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover vi | |
| CVE-2026-113501 | LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal | |
| CVE-2026-113500 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization | |
| CVE-2026-113499 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting | |
| CVE-2026-112230 | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter | |
| CVE-2026-112219 | Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved D | |
| CVE-2026-94267 | Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update | |
| CVE-2026-94264 | Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode A | |
| CVE-2026-94262 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeo |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Profile Builder
-
CVE-2026-112242
WordPress Profile Builder plugin <= 4.0.4 - Privilege Escala -
CVE-2026-96338
WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scrip -
CVE-2026-66701
WordPress Profile Builder plugin <= 3.16.5 - Broken Access C -
CVE-2025-49292
WordPress Profile Builder plugin <= 3.13.8 - Content Spoofin -
CVE-2024-31341
WordPress User Profile Builder plugin <= 3.11.2 - Bypass Vul
Same vendor: Unknown
-
CVE-2026-94263
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthe -
CVE-2026-94268
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated A -
CVE-2026-94262
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated N -
CVE-2026-94264
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contrib -
CVE-2026-94267
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated
V. Comments for CVE-2026-111965
No comments yet