A critical unauthenticated file upload vulnerability in the Cozmoslabs Profile Builder Plugin exposes WordPress sites to potential remote code execution and unauthorized file storage.

The vulnerability exists in the wppb_ajax_simple_avatar function within the Avatar Simple Upload AJAX Handler. It allows unauthenticated remote attackers to bypass security controls and perform unrestricted file uploads to the server.

Successful exploitation of this flaw allows an attacker to upload malicious files, such as web shells, directly to the server environment. This poses a significant risk of full site compromise, unauthorized data access, and potential lateral movement within the hosting infrastructure. Given the CVSS score of 7.3, the high accessibility of this vector necessitates immediate remediation to prevent site takeover.

Immediate Action: Update the Cozmoslabs Profile Builder Plugin to version 3.16.2 or later immediately to patch the insecure avatar upload handler.

Proactive Monitoring: Monitor server upload directories for unusual file types or unexpected script execution patterns. Review web server access logs for anomalous requests directed toward the wp-admin/admin-ajax.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious file uploads and restrict access to administrative AJAX endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up by Cipher Security Labs.

This vulnerability is high-severity because it provides an unauthenticated path for file injection. Administrators must prioritize updating the Profile Builder Plugin to version 3.16.2 immediately. Failure to apply this patch leaves the application susceptible to remote exploitation that could result in a complete system compromise.