CVE-2026-109447: User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]

Q: Which sites are actually exposed to exploitation?

A site is exposed only if it has User Profile Builder 4.0.3 or earlier, open user registration, email confirmation enabled, a public form using the [wppb-register] shortcode, and a legacy form field whose meta-name is role. The role field must have persisted from before the 4.0.3 upgrade.

Q: Does an attacker need an existing account or administrator access?

No. Exploitation is unauthenticated: an attacker can submit role=administrator through the public registration form, then activate the account using the email confirmation link.

Q: What account privileges can an attacker obtain?

The described exploit can result in a fully activated WordPress administrator account. This provides high impact to confidentiality, integrity, and availability.

Q: What can be checked to determine whether the vulnerable condition exists?

Review User Profile Builder registration forms for a pre-existing field with the meta-name role, and verify whether that form is publicly available through [wppb-register]. Also check whether open registration and email confirmation are enabled.

Q: What configuration changes can reduce exposure before patching?

Disable open user registration or email confirmation, and remove or rename any legacy registration-form field with the meta-name role. These changes break the stated exploitation prerequisites.

Published Oct 16, 2026

Updated

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the role parameter handled by the wppbaddmetatouseronactivation() function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to WPUser::setrole() with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name role to persist and bridge attacker-controlled request input into the serialized signup record stored in wpsignups. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting role=administrator through the public [wppb-register] shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name role carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.

Affected Software

1 affected component

Cozmoslabs User Profile Builder<=4.0.3

Event History

Oct 16, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are actually exposed to exploitation?

A site is exposed only if it has User Profile Builder 4.0.3 or earlier, open user registration, email confirmation enabled, a public form using the [wppb-register] shortcode, and a legacy form field whose meta-name is role. The role field must have persisted from before the 4.0.3 upgrade.

Does an attacker need an existing account or administrator access?

No. Exploitation is unauthenticated: an attacker can submit role=administrator through the public registration form, then activate the account using the email confirmation link.

What account privileges can an attacker obtain?

The described exploit can result in a fully activated WordPress administrator account. This provides high impact to confidentiality, integrity, and availability.

What can be checked to determine whether the vulnerable condition exists?

Review User Profile Builder registration forms for a pre-existing field with the meta-name role, and verify whether that form is publicly available through [wppb-register]. Also check whether open registration and email confirmation are enabled.

What configuration changes can reduce exposure before patching?

Disable open user registration or email confirmation, and remove or rename any legacy registration-form field with the meta-name role. These changes break the stated exploitation prerequisites.

CVE-2026-109447: User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]

Affected Software

Event History

Frequently Asked Questions

Which sites are actually exposed to exploitation?

Does an attacker need an existing account or administrator access?

What account privileges can an attacker obtain?

What can be checked to determine whether the vulnerable condition exists?

What configuration changes can reduce exposure before patching?

Company

Resources

Contact

Frequently Asked Questions

Which sites are actually exposed to exploitation?

Does an attacker need an existing account or administrator access?

What account privileges can an attacker obtain?

What can be checked to determine whether the vulnerable condition exists?

What configuration changes can reduce exposure before patching?