{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acozmoslabsuser_profile_builderwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cozmoslabs:user_profile_builder:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-115807"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-115807\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["User Profile Builder (\u003c= 4.0.3)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","web-application","cms"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe User Profile Builder plugin for WordPress (versions up to and including 4.0.3) contains a privilege escalation vulnerability. The plugin's Gutenberg Register block handles the 'Assigned Role' attribute insecurely, passing it directly into the \u003ccode\u003e[wppb-register]\u003c/code\u003e shortcode without performing server-side authorization. The current implementation only restricts roles with \u003ccode\u003emanage_options\u003c/code\u003e or \u003ccode\u003eremove_users\u003c/code\u003e capabilities, leaving other high-privileged roles, such as Editor, unprotected. This allows authenticated users with Author-level access or higher to elevate their privileges by creating new accounts with these elevated roles.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn authenticated attacker can successfully escalate their privileges by creating accounts with elevated roles (e.g., Editor). This could lead to unauthorized content modification, user management, or further exploitation of the WordPress instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the User Profile Builder plugin to the latest version once a fix is released.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user lists for unexpected account creations or unauthorized role assignments.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Gutenberg Register block to trusted users only.\u003c/li\u003e\n\u003cli\u003eMonitor the \u003ccode\u003ewp_user_registration\u003c/code\u003e process for anomalies if logging is available for the \u003ccode\u003e[wppb-register]\u003c/code\u003e shortcode execution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T07:08:05Z","date_published":"2026-10-24T06:09:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-user-profile-builder-privilege-escalation/","summary":"The User Profile Builder plugin for WordPress is vulnerable to privilege escalation because it fails to authorize the role assignment attribute in the Gutenberg Register block, allowing authenticated users to register accounts with higher-privileged roles.","title":"User Profile Builder: Privilege Escalation via Gutenberg Register block (CVE-2026-115807)","url":"https://feed.craftedsignal.io/briefs/2026-10-user-profile-builder-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:cozmoslabs:user_profile_builder:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}