Description
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.
Published: 2026-10-16
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows an unauthenticated user to submit a role parameter through the public registration form, which is then directly passed to the WordPress user role assignment function without validation. This results in the attacker being able to set the role to administrator, giving them full administrative control over the site. The weakness is a privilege escalation flaw.

Affected Systems

WordPress sites running the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin, versions up to and including 4.0.3. The issue applies when a legacy form field with meta-name role is present, email confirmation is enabled, and user registration is open. All affected sites must investigate whether the legacy field still exists.

Risk and Exploitability

The CVSS score is 8.1, indicating high severity. The EPSS score is not available, but the conditions for exploitation—an open registration form, legacy field, and email confirmation—are common in WordPress installations. The KEV status is not listed. The likely attack vector is a remote unauthenticated HTTP request to the public registration shortcode; attackers can trigger the vulnerability without authentication by submitting role=administrator through the form.

Generated by OpenCVE AI on October 16, 2026 at 14:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the User Profile Builder plugin to a version newer than 4.0.3, which removes the insecure role handling.
  • Delete or rename any legacy form fields with the meta-name 'role' to prevent the parameter from being carried into the signup record.
  • Disable user registration or email confirmation temporarily until the plugin is updated and legacy fields are removed.

Generated by OpenCVE AI on October 16, 2026 at 14:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Description The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.
Title User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-16T15:09:38.993Z

Reserved: 2026-10-12T16:12:22.990Z

Link: CVE-2026-109447

cve-icon Vulnrichment

Updated: 2026-10-16T14:59:55.125Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T06:17:08.020

Modified: 2026-10-16T15:17:07.557

Link: CVE-2026-109447

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T14:15:13Z

Weaknesses
  • CWE-269

    Improper Privilege Management