CVE-2026-109447 Overview
CVE-2026-109447 is a privilege escalation vulnerability in the User Profile Builder plugin for WordPress, affecting all versions up to and including 4.0.3. The flaw resides in the wppb_add_meta_to_user_on_activation() function, which passes the attacker-controlled role parameter directly to WP_User::set_role() without allow-list validation. Unauthenticated attackers can obtain a fully activated administrator account by submitting role=administrator through the public [wppb-register] shortcode form and following the email activation link. The weakness is tracked under CWE-269: Improper Privilege Management.
Critical Impact
Unauthenticated attackers can create WordPress administrator accounts, leading to full site takeover on affected installations.
Affected Products
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress
- All versions up to and including 4.0.3
- Sites with a legacy form field using meta-name role, email confirmation enabled, and open user registration
Discovery Timeline
- 2026-10-16 - CVE-2026-109447 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-109447
Vulnerability Analysis
The vulnerability is a privilege escalation flaw triggered during the Profile Builder email-confirmation activation flow. When a visitor submits the public [wppb-register] shortcode form, attacker-supplied field values are serialized into the wp_signups table alongside the pending user record. Upon activation, wppb_add_meta_to_user_on_activation() reads the stored role value and invokes WP_User::set_role() directly, elevating the newly activated account to whatever role the attacker specified.
The 4.0.3 release introduced a reserved-name check intended to block fields using sensitive meta-names such as role. However, the check exempts pre-existing form fields, so any legacy field with meta-name role carried over from earlier versions continues to flow through registration unchallenged. This bridges unauthenticated request input into the signup record and, ultimately, into the active user object.
Root Cause
The root cause is missing allow-list validation on the role meta value before it is passed to WP_User::set_role(). The activation handler trusts a value that originated in an unauthenticated public form, and the reserved-name block applied in 4.0.3 contains a legacy-field exemption that fails to neutralize the pre-existing dangerous field. See the Profile Builder admin-functions.php reference and the email-confirmation.php reference for the vulnerable code paths.
Attack Vector
An unauthenticated attacker locates a Profile Builder registration form rendered via the [wppb-register] shortcode on a target site. The attacker submits the form with an added role parameter set to administrator. The plugin serializes this value into the pending signup record stored in wp_signups. When the attacker clicks the email confirmation link delivered to their own inbox, the activation handler reads the stored role and promotes the new user to administrator. Prerequisites include a legacy role form field, email confirmation enabled, and open registration — all stable configuration states.
No verified exploit code is published. See the Wordfence vulnerability report and Profile Builder changeset #3741133 for the fix details.
Detection Methods for CVE-2026-109447
Indicators of Compromise
- New administrator accounts in wp_users that completed registration through the Profile Builder activation flow with no prior administrative provisioning.
- Rows in wp_signups whose serialized meta payload contains a role key with a privileged value such as administrator or editor.
- Profile Builder registration form POST requests containing an unexpected role form field.
- Role-change entries in site audit logs that occur during the activation link callback rather than through an admin-initiated action.
Detection Strategies
- Query wp_signups for pending or recently activated records where the serialized meta contains the string role paired with a privileged WordPress role.
- Review web server access logs for POST requests to the registration endpoint containing role= parameters from unauthenticated sources.
- Correlate newly promoted administrator accounts with the timestamp of Profile Builder activation link clicks.
Monitoring Recommendations
- Alert on any creation of accounts with administrator, editor, or other privileged roles outside approved provisioning workflows.
- Monitor Profile Builder form configuration for form fields using the reserved meta-name role.
- Enable WordPress audit logging for user_register and set_user_role events and ship them to a central analytics platform.
How to Mitigate CVE-2026-109447
Immediate Actions Required
- Update the User Profile Builder plugin to a version later than 4.0.3 that removes the legacy-field exemption from the reserved-name check.
- Audit all Profile Builder forms and delete any custom field whose meta-name is role before upgrading.
- Review wp_users and wp_usermeta for unauthorized administrator or editor accounts and remove them.
- Rotate credentials and session tokens for all legitimate administrator accounts if compromise is suspected.
Patch Information
The vendor addressed the issue in Profile Builder changeset #3741133, including corresponding changes to the email confirmation feature. Apply the fixed Profile Builder release through the WordPress plugin updater as the primary remediation.
Workarounds
- Temporarily disable open user registration in WordPress settings until the plugin is patched.
- Disable the email-confirmation feature in Profile Builder, which breaks the specific exploitation path described in this advisory.
- Remove or deactivate any Profile Builder form that contains a field with meta-name role.
- Place the registration endpoint behind a web application firewall rule that blocks POST requests containing a role parameter.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
