---
id: "CVE-2026-109447"
kind: "vulnerability"
aliases: ["CVE-2026-109447"]
title: "WordPress User Profile Builder plugin: signup can grant administrator role"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["no-public-registration-form", "plugin-updated", "registration-closed"]
published_at: "2026-10-16T06:17:08+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:07:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109447", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress User Profile Builder plugin: signup can grant administrator role

The User Profile Builder WordPress plugin up to and including 4.0.3 lets an unauthenticated visitor submit a role value during registration that is passed straight to the user role setter. A legacy form field named role can carry that value through email activation, letting the attacker become a full WordPress administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get profile-builder --field=version`
- In the WordPress admin, open the User Profile Builder form list and look for any field whose meta-name is `role` that was created before the 4.0.3 upgrade
- Check whether user registration is open and email confirmation is enabled in the plugin settings

## Fix

- Update the User Profile Builder plugin to a version newer than `4.0.3` (exact fixed version unknown from sources)
- Delete any legacy form field with meta-name `role` from the registration forms
- Review the administrator user list for accounts you did not create and remove them

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109447

## From the sources

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_