{
 "id": "WPSEC-2026-0888",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0888/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0888/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0888/index.md",
 "title": "User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via Select (User Role) Field",
 "description": "The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation via the Select (User Role) field in all versions up to, and including, 4.0.3. This is due to the wppb_check_user_role_value() function skipping allow-list validation of the submitted 'custom_field_user_role' value when the field was saved without a roles list, while the save routine accepts any posted role except 'administrator'. This makes it possible for unauthenticated attackers to register an account with a privileged role other than administrator, such as Editor or Shop Manager, on a registration form containing such a field. Exploitation requires a registration form with a User Role field that has no saved roles list.",
 "plugin": {
  "slug": "profile-builder",
  "name": "User Profile Builder",
  "full_name": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor",
  "wordpress_org": "https://wordpress.org/plugins/profile-builder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/profile-builder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/profile-builder"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.4",
 "remediation": "Update to 4.0.4 or later.",
 "fix_released": "2026-10-12T10:40:36+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:13:09.150362+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0888/",
  "https://plugins.svn.wordpress.org/profile-builder/tags/4.0.4/",
  "https://wordpress.org/plugins/profile-builder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/profile-builder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}