CVE-2026-109447
HighCVSS 8.1Summary
The User Profile Builder plugin for WordPress (versions up to and including 4.0.3) is vulnerable to privilege escalation via the 'role' parameter handled by the wppb_add_meta_to_user_on_activation() function. An unauthenticated attacker can gain a fully activated WordPress administrator account by submitting role=administrator through the public registration form and clicking the confirmation activation link.
Risk Assessment
Exploitation requires a legacy form field with meta-name 'role', email confirmation enabled, and open user registration, potentially leading to complete site takeover.
Recommendation
Update the User Profile Builder plugin to a version later than 4.0.3 or disable it; remove legacy form fields with meta-name 'role' and consider disabling open user registration.
Other vulnerabilities in User Profile Builder
See all- CVE-2026-100186High
The User Profile Builder plugin for WordPress (versions up to and including 4.0.3) is vulnerable to Stored Cross-Site Scripting via the First Name field due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.
- CVE-2026-15826Critical
The User Profile Builder plugin for WordPress up to version 3.16.4 is vulnerable to authentication bypass via type confusion. The wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress rejects it with a WP_Error object, but absint() coerces that object to the integer 1, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This allows unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover.
- CVE-2026-95866High
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress (up to and including 4.0.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.
- CVE-2026-93656Medium
The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Avatar Field in all versions up to and including 4.0.2 due to insufficient input sanitization and output escaping. It is exploitable via a nonce-free GET request to /wp-admin/profile.php without requiring a profile-form submission.
- CVE-2026-6431High
The User Profile Builder plugin for WordPress up to version 3.15.7 is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-75964Medium
The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to and including 4.0.0. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator visits the Unconfirmed Email Addresses list and interacts with row-action links.
- CVE-2026-75965Medium
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the wppb_toolbox_shortcodes_settings[format-date] option to be set to 'yes' by an administrator for the shortcode to be active and the vulnerability to be exploitable.
- CVE-2026-76548High
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.
- CVE-2026-76547Medium
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the plugin itself, so further impact requires a suitable gadget from another installed plugin.
- CVE-2026-76546Medium
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.
Original NVD description (English source)
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS