CVE-2026-109447

8.1High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-269

Impact

Unauthenticated attackers can create a fully activated WordPress administrator account over the network. They need open registration, email confirmation enabled, and a pre-existing legacy form field with meta-name 'role'.

Root cause

The activation function wppb_add_meta_to_user_on_activation() passes an attacker-supplied role parameter directly into WP_User::set_role() without allowlist validation.

Affected systems

User Profile Builder plugin for WordPress up to, and including, 4.0.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade the profile-builder plugin to a version newer than 4.0.3. If you cannot patch immediately, disable public user registration or delete any custom registration field with the meta-name 'role'.

shell

$ wp plugin update profile-builder

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109447