WordPress Plugin Allows Unauthorized Role Escalation via Unvalidated Parameters

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy fo

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The User Profile Builder plugin for WordPress contains a critical privilege escalation vulnerability in versions up to 4.0.3 that allows unauthenticated attackers to assign themselves arbitrary user roles during account activation. The vulnerability stems from insufficient input validation in the `wppb_add_meta_to_user_on_activation()` function, which accepts a `role` parameter without verifying it against an allowlist of permitted roles. This flaw directly impacts any WordPress installation using this plugin, affecting thousands of websites that rely on it for user registration and profile management. Attackers can exploit this during the user activation process to grant themselves administrative privileges, leading to complete site compromise.

Casky's 224 mapped security skills, powered by Claude AI's extended reasoning capabilities, would detect this attack pattern as a violation of TA0004 (Privilege Escalation) techniques. When analyzing plugin code and user activation workflows, practitioners would identify findings related to CWE-269 (Improper Access Control) through detection of unsanitized role assignments, missing input validation checks, and direct parameter passing to privilege-granting functions without verification. Casky's skill mapping would flag the absence of role allowlist validation, the bypass of security checks in version 4.0.3's reserved-name implementation, and the dangerous flow from user input directly to `WP_User::set_role()`. Security teams would see indicators of horizontal and vertical privilege escalation attempts in activation handler logs, enabling them to identify both successful exploitations and attack attempts before they compromise the WordPress environment.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-109447.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-109447

Casky has 224 skills that investigate the attack patterns behind CVE-2026-109447. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn