Is CVE-2026-115807 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115807 being exploited in the wild.

How severe is CVE-2026-115807?

High severity, with a CVSS score of 7.1, published 24 October 2026.

Which products and versions are affected?

WordPress.org User Profile Builder up to and including 4.0.3.

Is there a fix for CVE-2026-115807?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-115807 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-115807?

Check whether you run WordPress.org User Profile Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115807: User Profile Builder privilege escalation via Gutenberg Register block

CVE-2026-115807 · Severity: high · CVSS 7.1 · Published 2026-10-24

The User Profile Builder WordPress plugin allows users to create registration forms and manage user accounts. An authenticated attacker with Author-level access can exploit a flaw in the Gutenberg Register block to create new user accounts with elevated privileges, such as the Editor role, bypassing intended access controls. This could allow an attacker to gain significant control over a WordPress site's content and settings.

Vendors: WordPress.org.

Quick answers

Is CVE-2026-115807 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115807 being exploited in the wild.
How severe is CVE-2026-115807?: High severity, with a CVSS score of 7.1, published 24 October 2026.
Which products and versions are affected?: WordPress.org User Profile Builder up to and including 4.0.3.
Is there a fix for CVE-2026-115807?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-115807 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-115807?: Check whether you run WordPress.org User Profile Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation flaw in the Gutenberg Register block that passes the attacker-controlled "Assigned Role" attribute directly to the `[wppb-register]` shortcode without proper authorization. The role guard in the form builder only restricts roles with the manage_options or remove_users capabilities, leaving the Editor role and other privileged non-Administrator roles unrestricted. An authenticated attacker with Author or higher access can exploit this to create accounts with Editor or other restricted roles.

Affected products

Wordpress.org User Profile Builder up to and including 4.0.3

Timeline

2026-10-24: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.