{"id":"CVE-2026-109447","kind":"vulnerability","aliases":["CVE-2026-109447"],"related":[],"title":"WordPress User Profile Builder plugin: signup can grant administrator role","description":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.","summary":"The User Profile Builder WordPress plugin up to and including 4.0.3 lets an unauthenticated visitor submit a role value during registration that is passed straight to the user role setter. A legacy form field named role can carry that value through email activation, letting the attacker become a full WordPress administrator.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["no-public-registration-form","plugin-updated","registration-closed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get profile-builder --field=version`\n- In the WordPress admin, open the User Profile Builder form list and look for any field whose meta-name is `role` that was created before the 4.0.3 upgrade\n- Check whether user registration is open and email confirmation is enabled in the plugin settings","fix":"- Update the User Profile Builder plugin to a version newer than `4.0.3` (exact fixed version unknown from sources)\n- Delete any legacy form field with meta-name `role` from the registration forms\n- Review the administrator user list for accounts you did not create and remove them","status":"open","published_at":"2026-10-16T06:17:08+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:07:51+00:00","updated_at":"2026-10-25T03:07:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:07:51Z","model":"claude-haiku-5-5","output":{"fix":"- Update the User Profile Builder plugin to a version newer than `4.0.3` (exact fixed version unknown from sources)\n- Delete any legacy form field with meta-name `role` from the registration forms\n- Review the administrator user list for accounts you did not create and remove them","reach":"internet","title":"WordPress User Profile Builder plugin: signup can grant administrator role","impact":"high","summary":"The User Profile Builder WordPress plugin up to and including 4.0.3 lets an unauthenticated visitor submit a role value during registration that is passed straight to the user role setter. A legacy form field named role can carry that value through email activation, letting the attacker become a full WordPress administrator.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker becomes WordPress administrator, gaining full site control","analyst_note":"Confirm the first fixed version of User Profile Builder after 4.0.3 and the vendor advisory for exact update guidance; NVD record only was consulted.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get profile-builder --field=version`\n- In the WordPress admin, open the User Profile Builder form list and look for any field whose meta-name is `role` that was created before the 4.0.3 upgrade\n- Check whether user registration is open and email confirmation is enabled in the plugin settings","needs_analyst":true,"not_affected_if":["registration-closed","no-public-registration-form","plugin-updated"],"who_is_affected":"Sites running User Profile Builder at version 4.0.3 or older that have a public [wppb-register] form with open registration and email confirmation enabled. The risk is highest where a form field with meta-name role survived an earlier upgrade. Sites without the plugin, with registration closed, or without email confirmation are not exposed on the stated path.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":3607,"output_tokens":716,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109447':13A,16A '-2026':12A,15A '4.0.3':35B,104C,148C,243C 'account':203C 'activ':67B,118C,125C,200C,221C 'add':113C 'administr':9A,75B,202C,207C 'allow':143C,162C 'allow-list':142C 'attack':70B,130C,176C,195C 'attacker-control':175C 'attacker-suppli':129C 'beauti':80C 'becom':71B 'block':161C 'bridg':174C 'builder':4A,28B,79C 'carri':62B,238C 'check':152C 'click':218C 'condit':257C 'confirm':220C,246C 'control':177C 'cve':11A,14A 'direct':134C 'editor':88C 'email':66B,245C 'enabl':247C 'escal':96C 'establish':259C 'exempt':153C 'exist':122C,156C 'exploit':223C 'field':58B,158C,165C,232C 'form':57B,83C,157C,215C,231C 'full':73B 'fulli':199C 'function':119C 'gain':197C 'grant':8A 'handl':109C 'handler':126C 'host':20B 'includ':34B,103C 'input':179C 'legaci':56B,164C,230C 'let':36B,68B 'link':222C 'list':144C 'make':190C 'meta':114C,168C,235C 'meta-nam':167C,234C 'name':59B,151C,169C,236C 'open':249C 'packag':17B 'paramet':108C 'pass':48B,127C 'persist':172C 'plugin':5A,24B,30B,89C 'possibl':192C 'pre':155C 'pre-exist':154C 'privileg':95C 'profil':3A,27B,78C,85C 'public':210C 'record':184C 'regist':213C 'registr':45B,82C,251C 'request':178C 'requir':224C 'reserv':150C 'reserved-nam':149C 'role':10A,42B,53B,60B,87C,107C,132C,139C,170C,206C,237C 'self':19B 'self-host':18B 'serial':182C 'set':138C 'setter':54B 'shortcod':214C 'signup':6A,183C,188C 'site':226C,255C 'site-st':254C 'stabl':253C 'state':256C 'store':185C 'straight':49B 'submit':40B,205C 'subsequ':217C 'suppli':131C 'unauthent':38B,194C 'upgrad':244C 'user':2A,26B,52B,77C,81C,84C,86C,116C,137C,250C 'valid':145C 'valu':43B,64B,133C 'version':99C 'via':105C 'visitor':39B 'vulner':93C,121C 'wordpress':1A,21B,23B,29B,74B,91C,201C 'wordpress-plugin':22B 'wp':136C,187C 'wppb':112C,212C 'wppb-regist':211C","nicknames":[],"mitigations":[],"who_affected":"Sites running User Profile Builder at version 4.0.3 or older that have a public [wppb-register] form with open registration and email confirmation enabled. The risk is highest where a form field with meta-name role survived an earlier upgrade. Sites without the plugin, with registration closed, or without email confirmation are not exposed on the stated path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109447","severity":null,"published_at":"2026-10-16T06:17:08+00:00","modified_at":"2026-10-16T15:17:07+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}