CVE-2026-109447
Received Received - Intake

Privilege Escalation in User Profile Builder WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-109447
EUVD
EUVD-2026-102672

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in the User Profile Builder WordPress plugin. It allows unauthenticated attackers to gain administrator access by exploiting a flaw in the role parameter handling during user registration. The issue occurs because the plugin passes user-supplied role values directly to set_role() without proper validation, enabling attackers to set themselves as admins via a crafted registration form.

Detection Guidance

Check WordPress sites using the User Profile Builder plugin for versions up to 4.0.3. Inspect user registration forms for a legacy 'role' field. Review wp_signups table for unauthorized administrator role assignments. Look for unexpected admin accounts created via public registration.

Impact Analysis

If exploited, this vulnerability allows attackers to take full control of your WordPress site by creating an administrator account. This could lead to complete site compromise, data theft, malware installation, or defacement. The attack requires specific site conditions like legacy form fields, email confirmation, and open registration to be present.

Compliance Impact

This vulnerability could severely impact compliance by allowing unauthorized access to sensitive data. GDPR requires protecting personal data, but a compromised admin account could lead to data breaches. HIPAA requires strict access controls for health data, which would be violated if attackers gain admin access. Both standards mandate breach notification if exploited.

Mitigation Strategies

Upgrade the User Profile Builder plugin to the latest version immediately. Disable open user registration if not needed. Review all user accounts for unauthorized admin roles. Remove any legacy 'role' form fields from registration forms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109447. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart