Quick answers
- Is CVE-2026-66701 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66701 being exploited in the wild.
- How severe is CVE-2026-66701?
- Medium severity, with a CVSS score of 5.3, published 6 August 2026.
- Which products and versions are affected?
- Cozmoslabs Profile Builder <=3.16.5.
- Is there a fix for CVE-2026-66701?
- A patch was published on 2026-07-29: Patched in version 3.16.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-66701 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-66701?
- Check whether you run Cozmoslabs Profile Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control flaw in WordPress Profile Builder versions 3.16.5 and earlier that permits unauthenticated attackers to access pages and perform actions they should not be authorized to execute. The root cause involves insufficient permission checks on user-facing functionality, allowing an attacker to access other users' profile data via network-based requests without authentication. An attacker can retrieve sensitive user information including profile details, potentially leading to unauthorized data disclosure. The vulnerability was patched in version 3.16.6.
Affected products
- Cozmoslabs Profile Builder <=3.16.5
Timeline
- 2026-07-29: disclosed
- 2026-07-29: patched: Patched in version 3.16.6