Limited Privilege Escalation in User Profile Builder Plugin for WordPress

CVE-2026-115807

What is CVE-2026-115807?

The User Profile Builder plugin for WordPress is affected by a Limited Privilege Escalation vulnerability due to the improper handling of user roles. This issue arises from the Gutenberg Register block, which allows the assignment of user roles without adequate server-side validation. Specifically, the [wppb-register] shortcode directly incorporates the Assigned Role attribute from user input, providing an opportunity for authenticated users with Author access or higher to exploit this flaw. They can create new accounts with elevated permissions, including the Editor role, circumventing typical restrictions for non-Administrator roles. As a result, this vulnerability could lead to unauthorized access and modifications within WordPress sites.

References