User Profile Builder <= 4.0.4 - Authenticated (Editor+) Privilege Escalation via Registration Form 'role' Attribute
- ID
- WPSEC-2026-1355
- Plugin
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (profile-builder)
- Affected
- all versions before 4.0.5
- Remediation
- Update to 4.0.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-269
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- User Profile Builder on WPSec AttackSurface
- Fix released
- Published
Description
The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation via the 'role' attribute of the [wppb-register] shortcode and the registration forms built from it in all versions up to, and including, 4.0.4. This is due to the plugin only checking that the post author has the edit_others_posts capability, without verifying that the author can grant the capabilities of the requested role. Roles holding manage_options or remove_users were already downgraded to the default role. This makes it possible for authenticated attackers with Editor-level access and above to publish a registration form that assigns a more privileged role without those two capabilities, such as Shop Manager or a custom role, and then register an account with that role.
References
- https://wpsec.com/vuln/WPSEC-2026-1355/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.5/
- https://wordpress.org/plugins/profile-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS