User Profile Builder: Privilege escalation to administrator via legacy 'role' field
Summary
Up to and including version 4.0.3, the User Profile Builder plugin for WordPress allows unauthenticated attackers to obtain a fully activated WordPress administrator account. A legacy registration field with meta-name 'role' carries attacker-supplied input through the email confirmation process into the account activation. Exploitation requires such a legacy field, email confirmation enabled and open user registration.
Affected
- User Profile Builder (Cozmoslabs), all versions up to and including 4.0.3
Fixed in
Unknown. No fixed version has been confirmed for this CVE.
Workaround
- Disable open registration or email confirmation on all forms built with the plugin until the site is patched.
- In the form editor, remove any registration field with meta-name 'role' that is no longer needed.
Exploitation
- No reports of active exploitation found.
- No public proof of concept found.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Check every WordPress site for the plugin and its version, and update to the latest release.
- Remove legacy 'role' fields and disable open registration where it is not required.
- Review pending signups and check the user list for administrator accounts created since 16 October 2026.
- Verify that the site is not affected by other known unauthenticated flaws in this plugin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence entry www.wordfence.com
- WordPress plugin changeset 3741133 plugins.trac.wordpress.org
- Changed email confirmation code in changeset 3741133 plugins.trac.wordpress.org
- Plugin 4.0.3 email confirmation source plugins.trac.wordpress.org
- Plugin 4.0.3 form builder source plugins.trac.wordpress.org
- Plugin 4.0.3 registration source plugins.trac.wordpress.org
- CVE record at threatint cve.threatint.com
- Wordfence 2020 critical vulnerability in Profile Builder www.wordfence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:54.
Original description (NVD)
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.
NVD references (8)
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confi…
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91
- https://plugins.trac.wordpress.org/changeset/3741133/profile-builder
- https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.