WP User Profiles
WP User Profiles has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 1 is fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 7.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Improper Privilege Management, behind 2 of the records (100%).
1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. WP User Profiles is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-31524WP User Profiles <= 2.6.2 - Authenticated (Subscriber+) Privilege Escalation
Read the full analysisVulnerability Records
WP User Profiles
Author
John James Jacoby
WP User Profiles is a sophisticated way to edit users in WordPress. Includes all functionality from WordPress itself Includes 4 top-level “Sections” Includes an “Other” section to automatically work with third-party plugins Each section includes 1 or more meta-boxes Status meta-box allows easily changing user status Works great with multisite Network and User Dashboards Works great with WP User Groups and WP User Avatars plugins Recommended Plugins If you like this plugin, you’ll probably like these! WP User Profiles WP User Activity WP User Avatars WP User Groups WP User Signups WP Term Authors WP Term Colors WP Term Families WP Term Icons WP Term Images WP Term Locks WP Term Order WP Term Visibility WP Media Categories WP Pretty Filters WP Chosen
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C