CVE-2026-115807

The vulnerability arises from the WordPress Gutenberg block used by the User Profile Builder plugin. The block’s "Assigned Role" attribute is passed directly into the [wppb-register] shortcode without any server‑side privilege validation. The plugin’s role guard only downgrades roles that have the manage_options or remove_users capability, leaving the Editor role and other privileged non‑Administrator roles fully unrestricted. Consequently, an attacker who is authenticated with Author or higher access can craft a Gutenberg block or request containing an arbitrary role attribute and create a new WordPress account that is assigned the Editor role (or any other role lacking those two capabilities). This flaw enables a limited privilege escalation, granting the attacker elevated permissions within the site’s permission hierarchy.

The issue affects the cozmoslabs product "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor" for all releases up to and including version 4.0.3. Users should verify the installed version and determine whether a newer release (e.g., 4.0.4 or later) contains a fix. If an update is not yet available, the plugin remains vulnerable.

The CVSS score of 7.1 rates this as a high severity vulnerability. The EPSS score is not available, but the flaw is not listed in the CISA KEV catalog. Because exploitation requires the attacker to be authenticated with at least Author privileges, the attack vector is authenticated and requires the ability to edit Gutenberg blocks or submit requests to the block registration endpoint. If the plugin is active and the block is accessible to Authors, an attacker can simply supply a crafted block with the "Assigned Role" attribute set to an elevated role, thereby bypassing normal role restrictions and escalating permissions. The resulting compromise is site‑wide if the attacker obtains an Editor account, increasing the impact on confidentiality, integrity, and availability.