CVE-2026-115807 Details
Description
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).
A limited privilege escalation vulnerability has been identified in the User Profile Builder WordPress plugin, specifically in versions through 4.0.3. The issue arises because the Gutenberg Register block transmits the attacker-controlled Assigned Role attribute directly to the '[wppb-register]' shortcode without proper server-side validation. The existing role guard only restricts roles with manage_options or remove_users capabilities, leaving the Editor role and other non-Administrator roles unprotected. This vulnerability allows authenticated users with Author-level access or higher to create new WordPress accounts with the Editor role or any other role that does not possess the two restricted capabilities.
Users are advised to update the User Profile Builder plugin to version 4.0.4 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.trac.wordpress.org/changeset/3741133/profile-builder | [email protected] | Content WallVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/21931b7b-3c3d-4297-878e-bc0f187557a0?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| User Profile Builder | <= 4.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2026 | New CVE Received | [email protected] |