User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via Select (User Role) Field
- ID
- WPSEC-2026-0888
- Plugin
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (profile-builder)
- Affected
- all versions before 4.0.4
- Remediation
- Update to 4.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- User Profile Builder on WPSec AttackSurface
- Fix released
- Published
Description
The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation via the Select (User Role) field in all versions up to, and including, 4.0.3. This is due to the wppb_check_user_role_value() function skipping allow-list validation of the submitted 'custom_field_user_role' value when the field was saved without a roles list, while the save routine accepts any posted role except 'administrator'. This makes it possible for unauthenticated attackers to register an account with a privileged role other than administrator, such as Editor or Shop Manager, on a registration form containing such a field. Exploitation requires a registration form with a User Role field that has no saved roles list.
References
- https://wpsec.com/vuln/WPSEC-2026-0888/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.4/
- https://wordpress.org/plugins/profile-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS