CVE-2026-3717: Bestwpdeveloper Wp Cv Builder

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files.

Affected products

• Bestwpdeveloper Wp Cv Builder: up to and including 1.3.1

Published 2026-10-10. Last modified 2026-10-10.