CVE-2026-109447— User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
Quick assessment
Affected
cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor" 在 4.0.3 及之前的所有版本中存在权限提升漏洞。该漏洞源于 函数对 参数的处理：激活处理器将攻击者提供的角色值直接传递给 ，而未进行白名单验证。此外，4.0.3 版本中的保留名称检查机制豁免了预先存在的表单字段，导致一个元数据名称（meta-name）为 的遗留字段得以保留，从而将攻击者可控的请求输入桥
Possible ATT&CK Techniques 3 AI
T1548 · Abuse Elevation Control Mechanism T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| cozmoslabs | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | ≤ 4.0.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109447
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
Source: CVE Program / CVE List V5
Vulnerability Description
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| cozmoslabs | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 0 ~ 4.0.3 | - |
|
II. Public POCs for CVE-2026-109447
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109447
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-109447 (1)
Vendor Pages for CVE-2026-109447 (1)
Other References for CVE-2026-109447 (1)
Same Patch Batch · cozmoslabs · 2026-10-16 · 4 CVEs total
| CVE-2026-100186 | 7.2 HIGH | User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name |
| CVE-2026-107768 | 7.2 HIGH | TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor h |
| CVE-2026-107748 | 6.4 MEDIUM | User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vi |
IV. Related Vulnerabilities
Same product: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
-
CVE-2026-100186
User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross -
CVE-2026-107748
User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) -
CVE-2026-93656
User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) -
CVE-2026-95866
User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross -
CVE-2026-6431
User Profile Builder <= 3.15.7 - Unauthenticated Stored Cros
Same vendor: cozmoslabs
-
CVE-2026-107768
TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site -
CVE-2026-100186
User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross -
CVE-2026-107748
User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) -
CVE-2026-105317
WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL In -
CVE-2026-103062
WordPress TranslatePress plugin <= 3.3.6 - Cross Site Script
Same weakness: CWE-269
-
CVE-2026-17491
IBM i is Affected By An Improper Privilege Management Vulner -
CVE-2026-102917
IBM i is Affected By An Improper Privilege Management Vulner -
CVE-2026-111708
WhaTicket Community through commit cf04795 Admin Self-Regist -
CVE-2026-104755
WP Compress <= 7.25.00 - Unauthenticated Privilege Escalatio -
CVE-2026-85659
PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege
V. Comments for CVE-2026-109447
No comments yet