CVE-2026-115807: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the [wppb-register] shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manageoptions or removeusers capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated WordPress user with Author-level access or higher can exploit it. The attacker must be able to use the Gutenberg Register block and control its Assigned Role attribute.
What level of access can an attacker obtain?
An attacker can create a new account with the Editor role, or another role that does not have the manage_options or remove_users capability. Administrator-level roles protected by either of those capability checks are downgraded by the form builder guard.
Are standard installations affected?
Affected plugin versions through 4.0.3 are vulnerable when an Author-or-higher user can create or modify content containing the Gutenberg Register block. Exploitation does not require user interaction.
How can I check for exploitation?
Review WordPress user-account creation records and the current user list for unexpected accounts assigned Editor or other privileged non-Administrator roles. Also inspect Gutenberg content using the Register block for Assigned Role values that grant such roles.