{
 "id": "WPSEC-2026-0891",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0891/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0891/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0891/index.md",
 "title": "User Profile Builder <= 4.0.3 - Authenticated (Author+) Privilege Escalation via Register Block and Elementor Widget",
 "description": "The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation via the Register Gutenberg block and the Elementor registration widget in all versions up to, and including, 4.0.3. This is due to these renderers not enforcing the rule that stops post authors without the edit_others_posts capability from embedding registration forms, a rule the register shortcode already applied. This makes it possible for authenticated attackers with Author-level access and above to publish a registration form set to a privileged role that has neither the manage_options nor the remove_users capability, such as Editor, and use it to create accounts with that role.",
 "plugin": {
  "slug": "profile-builder",
  "name": "User Profile Builder",
  "full_name": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor",
  "wordpress_org": "https://wordpress.org/plugins/profile-builder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/profile-builder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/profile-builder"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-284"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.4",
 "remediation": "Update to 4.0.4 or later.",
 "fix_released": "2026-10-12T10:40:36+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:13:09.150362+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0891/",
  "https://plugins.svn.wordpress.org/profile-builder/tags/4.0.4/",
  "https://wordpress.org/plugins/profile-builder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/profile-builder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}