User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via 'role' Custom Field on Registration with Email Confirmation
- ID
- WPSEC-2026-0890
- Plugin
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (profile-builder)
- Affected
- all versions before 4.0.4
- Remediation
- Update to 4.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- User Profile Builder on WPSec AttackSurface
- Fix released
- Published
Description
The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 due to the registration handler letting a submitted custom field with the meta name 'role' override the form's role when Email Confirmation is enabled, and the activation routine applying that stored role without validation. This makes it possible for unauthenticated attackers to register an account that is assigned an arbitrary role, such as administrator, once the email is confirmed. Exploitation requires Email Confirmation to be enabled and a registration form containing a legacy field with the meta name 'role'.
References
- https://wpsec.com/vuln/WPSEC-2026-0890/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.4/
- https://wordpress.org/plugins/profile-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS