# User Profile Builder <= 4.0.4 - Authenticated (Editor+) Privilege Escalation via Registration Form 'role' Attribute

- **ID:** WPSEC-2026-1355
- **Plugin:** User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (`profile-builder`), https://wordpress.org/plugins/profile-builder/
- **Affected versions:** all versions before 4.0.5
- **Fixed in:** 4.0.5 (Update to 4.0.5 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/profile-builder
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1355/

## Description

The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation via the 'role' attribute of the [wppb-register] shortcode and the registration forms built from it in all versions up to, and including, 4.0.4. This is due to the plugin only checking that the post author has the edit_others_posts capability, without verifying that the author can grant the capabilities of the requested role. Roles holding manage_options or remove_users were already downgraded to the default role. This makes it possible for authenticated attackers with Editor-level access and above to publish a registration form that assigns a more privileged role without those two capabilities, such as Shop Manager or a custom role, and then register an account with that role.

## References

- https://wpsec.com/vuln/WPSEC-2026-1355/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.5/
- https://wordpress.org/plugins/profile-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1355/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.