# CVE-2026-109447: User Profile Builder privilege escalation via role parameter

Source: https://junglewise.ai/threats/cve-2026-109447-the-user-profile-builder-beautiful-user-registration-forms-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109447 · Severity: high · CVSS 8.1 · Published 2026-10-16

User Profile Builder is a WordPress plugin that manages user registration and profiles. An unauthenticated attacker can exploit a flaw in the user activation process to gain full administrator access to the WordPress site by injecting a malicious role parameter during registration. The attack requires email confirmation to be enabled and uses a legacy form field to bypass security checks.

Technologies: [Cozmoslabs User Profile Builder](https://junglewise.ai/threats/technologies/user-profile-builder). Vendors: [Cozmoslabs](https://junglewise.ai/threats/vendors/cozmoslabs).

## Quick answers

**Is CVE-2026-109447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109447 being exploited in the wild.

**How severe is CVE-2026-109447?** High severity, with a CVSS score of 8.1, published 16 October 2026.

**Which products and versions are affected?** Cozmoslabs User Profile Builder up to and including 4.0.3.

**Is there a fix for CVE-2026-109447?** No fixed version is recorded yet. Disable user registration or email confirmation until a patched version is applied. Alternatively, remove any legacy form fields with meta-name `role` from the plugin configuration. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109447 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109447?** Check whether you run Cozmoslabs User Profile Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable user registration or email confirmation until a patched version is applied. Alternatively, remove any legacy form fields with meta-name `role` from the plugin configuration.

## Technical details

The plugin's activation handler in `wppb_add_meta_to_user_on_activation()` passes attacker-supplied role values directly to `WP_User::set_role()` without validation. A reserved-name check in version 4.0.3 incorrectly exempts pre-existing form fields, allowing a legacy field with meta-name `role` to persist and bridge attacker input into the signup record. An unauthenticated attacker can submit `role=administrator` via the public registration form and activate as an admin through the confirmation link.

## Affected products

- Cozmoslabs User Profile Builder up to and including 4.0.3

## Timeline

- 2026-10-16: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php](https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php)
- [https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php](https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php)

## Related threats

- [User Profile Builder reflected XSS in admin page](https://junglewise.ai/threats/cve-2026-111948-the-user-profile-builder-wordpress-plugin-before-4-0-1-does-not)
- [User Profile Builder display_name stored XSS](https://junglewise.ai/threats/cve-2026-107748-the-user-profile-builder-beautiful-user-registration-forms-user)
- [User Profile Builder stored cross-site scripting in first name field](https://junglewise.ai/threats/cve-2026-100186-the-user-profile-builder-beautiful-user-registration-forms-user)
- [User Profile Builder authentication bypass in file upload](https://junglewise.ai/threats/cve-2026-76548-user-profile-builder-authentication-bypass-in-file-upload)
- [User Profile Builder stored XSS in format date shortcode](https://junglewise.ai/threats/cve-2026-76546-user-profile-builder-stored-xss-in-format-date-shortcode)