# User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via 'role' Custom Field on Registration with Email Confirmation

- **ID:** WPSEC-2026-0890
- **Plugin:** User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (`profile-builder`), https://wordpress.org/plugins/profile-builder/
- **Affected versions:** all versions before 4.0.4
- **Fixed in:** 4.0.4 (Update to 4.0.4 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/profile-builder
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0890/

## Description

The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 due to the registration handler letting a submitted custom field with the meta name 'role' override the form's role when Email Confirmation is enabled, and the activation routine applying that stored role without validation. This makes it possible for unauthenticated attackers to register an account that is assigned an arbitrary role, such as administrator, once the email is confirmed. Exploitation requires Email Confirmation to be enabled and a registration form containing a legacy field with the meta name 'role'.

## References

- https://wpsec.com/vuln/WPSEC-2026-0890/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.4/
- https://wordpress.org/plugins/profile-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0890/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.