CVE-2026-109447: User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the role parameter handled by the wppbaddmetatouseronactivation() function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to WPUser::setrole() with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name role to persist and bridge attacker-controlled request input into the serialized signup record stored in wpsignups. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting role=administrator through the public [wppb-register] shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name role carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.
Affected Software
Event History
Frequently Asked Questions
Which sites are actually exposed to exploitation?
A site is exposed only if it has User Profile Builder 4.0.3 or earlier, open user registration, email confirmation enabled, a public form using the [wppb-register] shortcode, and a legacy form field whose meta-name is role. The role field must have persisted from before the 4.0.3 upgrade.
Does an attacker need an existing account or administrator access?
No. Exploitation is unauthenticated: an attacker can submit role=administrator through the public registration form, then activate the account using the email confirmation link.
What account privileges can an attacker obtain?
The described exploit can result in a fully activated WordPress administrator account. This provides high impact to confidentiality, integrity, and availability.
What can be checked to determine whether the vulnerable condition exists?
Review User Profile Builder registration forms for a pre-existing field with the meta-name role, and verify whether that form is publicly available through [wppb-register]. Also check whether open registration and email confirmation are enabled.
What configuration changes can reduce exposure before patching?
Disable open user registration or email confirmation, and remove or rename any legacy registration-form field with the meta-name role. These changes break the stated exploitation prerequisites.