User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Authenticated (Author+) Privilege Escalation via Register Form in Query Loop and Block-Rendered Content
- ID
- WPSEC-2026-2007
- Plugin
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (profile-builder)
- Affected
- all versions before 4.0.6
- Remediation
- Update to 4.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor on WPSec AttackSurface
- Fix released
- Published
Description
The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation via the Register form and the [wppb-register] shortcode in all versions up to, and including, 4.0.5, due to wppb_front_end_register() checking only the post returned by get_the_ID() when deciding whether a post author may publish a registration form and which role it may assign. A Register block placed inside a Query Loop is checked against the author of the looped post. Register shortcode text in excerpts, titles or embeds rendered by blocks is expanded by the outer page's do_shortcode() and checked against that page's author. This makes it possible for authenticated attackers with author-level access and above to publish a registration form that assigns a role they cannot grant, such as administrator, and then register an administrator account.
References
- https://wpsec.com/vuln/WPSEC-2026-2007/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.6/
- https://wordpress.org/plugins/profile-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS