User Profile Builder CVE-2026-115807

Requires an authenticated WordPress account at Author level or above (per CVSS PR:L) on a site running User Profile Builder ≤4.0.3. The attacker must be able to insert the Gutenberg 'Register' block and set its attacker-controlled Assigned Role attribute, which is passed into the [wppb-register] shortcode without server-side authorization. Exploitation is bounded by the role guard: roles carrying the manage_options or remove_users capability (notably Administrator) are downgraded, so the attacker can grant Editor or other privileged non-Administrator roles but cannot directly create an Administrator. Limiting factors: need for a pre-existing Author+ account, and the inability to escalate straight to full admin.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N = 7.1) shows network reach and low complexity, but PR:L means the attacker must already hold an authenticated account at Author level or above - a meaningful barrier on most sites, where Author accounts are not handed out freely. The vuln.today decision label is 'this_week' (not act_now or emergency), which aligns with a serious-but-containable privilege-escalation flaw. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no exploitation-probability signal to weigh - do not infer active exploitation. The flaw is a 'Limited' privilege escalation by design: the role guard still blocks roles carrying manage_options or remove_users, so an attacker cannot mint a true Administrator, but Editor (and similarly privileged non-admin roles) remain fully grantable, and an Editor account is powerful enough (content control, media upload) to plausibly chain toward further compromise. Net: prioritize patching for sites that allow self-registration or hand out Author+ accounts, but the Author prerequisite and the inability to directly reach Administrator keep this below critical real-world urgency.

An attacker who already holds (or obtains via open registration) an Author-level WordPress account adds a Gutenberg Register block to a post or page and sets its Assigned Role attribute to 'Editor'. Because the value flows straight into the [wppb-register] shortcode without server-side authorization and the role guard only blocks manage_options/remove_users roles, anyone registering through that form - including the attacker - receives a privileged Editor account. No public exploit code is identified in the provided data; disclosure is credited to Wordfence.