# User Profile Builder <= 4.0.3 - Authenticated (Author+) Privilege Escalation via Register Block and Elementor Widget

- **ID:** WPSEC-2026-0891
- **Plugin:** User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (`profile-builder`), https://wordpress.org/plugins/profile-builder/
- **Affected versions:** all versions before 4.0.4
- **Fixed in:** 4.0.4 (Update to 4.0.4 or later.)
- **Severity:** High 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-284
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/profile-builder
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0891/

## Description

The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation via the Register Gutenberg block and the Elementor registration widget in all versions up to, and including, 4.0.3. This is due to these renderers not enforcing the rule that stops post authors without the edit_others_posts capability from embedding registration forms, a rule the register shortcode already applied. This makes it possible for authenticated attackers with Author-level access and above to publish a registration form set to a privileged role that has neither the manage_options nor the remove_users capability, such as Editor, and use it to create accounts with that role.

## References

- https://wpsec.com/vuln/WPSEC-2026-0891/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.4/
- https://wordpress.org/plugins/profile-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0891/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.