Disclosure summary
The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files.
Source-reported weakness categories
CWE-862
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST NVD · NVD-CVE-2026-3717
Open original source · Updated Oct 11, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
Src 0f59f6023c0f58ce2c · RSS-95eb7d8256449b8a75dc66291b65bfe37a2
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_1400Z
CVE mention in publisher metadata; check the original affected versions.
Original records & references
GitHub repository matches
Repository matches are links and GitHub-supplied metadata only. They are not verified working proof-of-concept code. Each supported query is bounded to ten pages and at most 1,000 indexed results. This is not a complete index of GitHub or public exploit research. Coverage can also be limited by provider availability, rate limits, rejected metadata, incomplete search results, manual review, and the recorded refresh time.
No stored repository matches
Repository discovery has not recorded an update for this CVE yet.
Discovery progress
0 of 3 discovery queries finished. GitHub returned 0 indexed results; 0 malformed or disallowed results were rejected.
No discovery update has been recorded for this CVE.
View all 0 stored repository matches
PUBLISHED 2026-10-10T07:16:41+00:00
MODIFIED 2026-10-11T17:17:05+00:00
INGESTED 2026-10-12T00:40:31+00:00