{"schema":"threatline.record/2","record":{"id":"CVE-2026-109447","aliases":[],"summary":"User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]","details":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.","categories":["Unclassified"],"product":"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","vendor":"cozmoslabs","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109447","source_modified_at":"2026-10-16T15:09:38.993Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor","vendor":"cozmoslabs","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.3","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00335,"percentile":0.25663,"score_date":"2026-10-23"},"published_at":"2026-10-16T05:30:24.704Z","modified_at":"2026-10-16T15:09:38.993Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-109447","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T15:09:38.993Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109447","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L262"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3741133/profile-builder"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-confirmation.php"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-16T14:55:57.521767Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T15:09:38.993Z","content_hash":"4df2d4d64ba8c73e301667624052f80258375b2e61875ef0e62b41848342aff9"}}