User Profile Builder: Privilege Escalation via Gutenberg Register block (CVE-2026-115807)

The User Profile Builder plugin for WordPress (versions up to and including 4.0.3) contains a privilege escalation vulnerability. The plugin's Gutenberg Register block handles the 'Assigned Role' attribute insecurely, passing it directly into the [wppb-register] shortcode without performing server-side authorization. The current implementation only restricts roles with manage_options or remove_users capabilities, leaving other high-privileged roles, such as Editor, unprotected. This allows authenticated users with Author-level access or higher to elevate their privileges by creating new accounts with these elevated roles.

Impact

An authenticated attacker can successfully escalate their privileges by creating accounts with elevated roles (e.g., Editor). This could lead to unauthorized content modification, user management, or further exploitation of the WordPress instance.

Recommendation

• Update the User Profile Builder plugin to the latest version once a fix is released.
• Audit WordPress user lists for unexpected account creations or unauthorized role assignments.
• Restrict access to the Gutenberg Register block to trusted users only.
• Monitor the wp_user_registration process for anomalies if logging is available for the [wppb-register] shortcode execution.