User Profile Builder <= 4.0.3 - Authenticated (Author+) Privilege Escalation via Register Block and Elementor Widget
- ID
- WPSEC-2026-0891
- Plugin
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (profile-builder)
- Affected
- all versions before 4.0.4
- Remediation
- Update to 4.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-284
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- User Profile Builder on WPSec AttackSurface
- Fix released
- Published
Description
The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation via the Register Gutenberg block and the Elementor registration widget in all versions up to, and including, 4.0.3. This is due to these renderers not enforcing the rule that stops post authors without the edit_others_posts capability from embedding registration forms, a rule the register shortcode already applied. This makes it possible for authenticated attackers with Author-level access and above to publish a registration form set to a privileged role that has neither the manage_options nor the remove_users capability, such as Editor, and use it to create accounts with that role.
References
- https://wpsec.com/vuln/WPSEC-2026-0891/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.4/
- https://wordpress.org/plugins/profile-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS