Key points
- CVE-2026-109447 carries a CVSS score of 8.1, rated high severity.
- The flaw allows unauthenticated users to escalate privileges to administrator.
- Exploitation requires specific legacy form field conditions on the site.
The User Profile Builder plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 4.0.3. According to the National Vulnerability Database, this flaw allows unauthenticated attackers to gain full administrator access through the public registration shortcode.
The vulnerability stems from how the plugin handles the `role` parameter during user activation. The `wppb_add_meta_to_user_on_activation()` function passes attacker-supplied role values directly to WordPress without allow-list validation. This bypass occurs because the 4.0.3 reserved-name check exempts pre-existing form fields, allowing legacy fields with the meta-name `role` to persist and bridge input into the signup record.
Exploitation mechanics
Attackers exploit this by submitting `role=administrator` through the public `[wppb-register]` shortcode form. After submission, the attacker clicks the confirmation activation link. This action triggers the activation handler, which processes the malicious role value. The result is a fully activated WordPress administrator account for the unauthenticated user, granting complete control over the site.
Affected environments
The flaw affects sites using the User Profile Builder plugin by cozmoslabs in versions up to 4.0.3. Successful exploitation requires three specific site-state conditions: open user registration must be enabled, email confirmation must be active, and the site must have a legacy form field with the meta-name `role` carried over from before the 4.0.3 upgrade. These conditions are stable once established.
Next steps
The source material identifies the vulnerability in versions up to 4.0.3 but does not state whether a patch or fix has been released. Site administrators should verify if their installations meet the exploitation criteria, particularly the presence of legacy role fields. Monitoring vendor communications for updates is recommended.
Signals worth monitoring
Teams usually detect this activity by reviewing user creation logs for unexpected role assignments during the activation phase. Check whether new administrator accounts were created via public registration forms rather than internal admin panels. Look for anomalies in the `wp_signups` table where serialized data contains elevated privileges. Monitor authentication logs for successful logins from new accounts that immediately access administrative interfaces, which often indicates automated exploitation attempts.
What to do and how to stay safe: WordPress
- Audit existing user registration forms to identify and remove any legacy fields with the meta-name `role`.
- Restrict user registration capabilities to trusted sources if public sign-up is not strictly necessary.
- Monitor server logs for unusual spikes in new user activations, especially those resulting in administrator privileges.
- Check for vendor updates that address the validation bypass in the activation handler.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109447?
The National Vulnerability Database rates the severity as high with a CVSS score of 8.1.
Can any version of User Profile Builder be exploited?
All versions up to and including 4.0.3 are vulnerable, but only if specific legacy field conditions exist.
Does this require authentication to exploit?
No, the vulnerability allows unauthenticated attackers to gain administrator access through the public registration form.
