CVE-2026-3717

Name of the Vulnerable Software and Affected Versions CV Builder – Professional Resume Builder SaaS versions prior to 1.3.2

Description The plugin contains a flaw allowing unauthenticated attackers to perform unauthorized arbitrary file uploads. This occurs because the wp save signature image() function lacks a proper capability check, enabling the upload of arbitrary content to the WordPress uploads directory disguised as png files.

Recommendations Update the plugin to version 1.3.2 or later. As a temporary mitigation, restrict access to the wp save signature image() function.