# User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via Select (User Role) Field

- **ID:** WPSEC-2026-0888
- **Plugin:** User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (`profile-builder`), https://wordpress.org/plugins/profile-builder/
- **Affected versions:** all versions before 4.0.4
- **Fixed in:** 4.0.4 (Update to 4.0.4 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/profile-builder
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0888/

## Description

The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation via the Select (User Role) field in all versions up to, and including, 4.0.3. This is due to the wppb_check_user_role_value() function skipping allow-list validation of the submitted 'custom_field_user_role' value when the field was saved without a roles list, while the save routine accepts any posted role except 'administrator'. This makes it possible for unauthenticated attackers to register an account with a privileged role other than administrator, such as Editor or Shop Manager, on a registration form containing such a field. Exploitation requires a registration form with a User Role field that has no saved roles list.

## References

- https://wpsec.com/vuln/WPSEC-2026-0888/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.4/
- https://wordpress.org/plugins/profile-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0888/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.