Read the docs
TI-2026-80029 Aliases CVE-2026-115807GHSA-4c28-jc56-4ggg

Privilege escalation in User Profile Builder plugin for WordPress

Priority LOW 31CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

The User Profile Builder plugin for WordPress through 4.0.3 has an improper privilege management flaw (CWE-269). The Gutenberg Register block passes the attacker-controlled Assigned Role attribute to the wppb-register shortcode without server-side authorization, and the role guard only downgrades roles with manage_options or remove_users, leaving the Editor role unrestricted. An authenticated attacker with Author access or higher can create new accounts with the Editor role.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0021 11th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CozmoslabsUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editorup to 4.0.3—No fix listedCNA
  • User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor VendorCozmoslabs Affected up to 4.0.3 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cozmoslabs:profile_builder:*:*:*:*:*:*:*:*——Cozmoslabs
  • cpe:2.3:a:cozmoslabs:profile_builder:*:*:*:*:*:*:*:* Versions — — ·Cozmoslabs

Remediation

The sources list no fixed version for the User Profile Builder plugin (Beautiful User Registration Forms, User Profiles & User Role Editor).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-24 Threatist record created from CVE-2026-115807
  2. 2026-10-24 Alias added: GHSA-4c28-jc56-4ggg
  3. 2026-10-24 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed

References

Other 2

  • TI-2024-06204 profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation CVSS 3.1CRITICAL 9.8
  • TI-2024-05908 User Profile Builder < 3.11.8 - Unauthenticated Media Upload CVSS 3.1CRITICAL 9.1
  • TI-2026-56948 Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload CVSS 4.0MEDIUM 6.9
  • TI-2026-15943 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure CVSS 3.1CRITICAL 9.8
  • TI-2026-13308 Incorrect type conversion in Cozmoslabs User Profile Builder – Beautiful User… CVSS 3.1CRITICAL 9.8
  • TI-2024-06217 Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting CVSS 3.1MEDIUM 4.8
See all 99 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences