User Profile Builder EUVD-2026-102672

Exploitation requires three concurrent, stable site-state conditions explicitly named in the advisory: (1) a legacy Profile Builder form field with meta-name 'role' carried over from before the 4.0.3 upgrade (the 4.0.3 reserved-name check exempts pre-existing fields, so it persists), (2) email confirmation enabled so the wp_signups activation path is used, and (3) open/public user registration via the [wppb-register] shortcode. The attacker needs no authentication (PR:N) and no third-party interaction (UI:N) - they click their own activation link. The limiting factor is the legacy 'role' field: fresh installs or sites that never defined such a field are not exploitable, which is precisely why CVSS is scored AC:H rather than AC:L. Affected products are all User Profile Builder versions up to and including 4.0.3.

This is a genuine high-impact issue whose real-world risk is meaningfully tempered by its preconditions, so it should be triaged as important-but-conditional rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1) correctly captures that the outcome is catastrophic - an unauthenticated attacker obtaining a fully activated administrator account (full confidentiality, integrity, and availability loss) - while the AC:H flag reflects that exploitation is not universal: it depends on specific stable site-state conditions. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no signal of active or widespread exploitation; the issue was reported by Wordfence (a credible WordPress security vendor) rather than observed in attacks. The key nuance is that the AC:H and PR:N/UI:N combination can look contradictory - 'unauthenticated, no interaction' suggests trivial mass exploitation, but AC:H and the description together show the attacker needs the target to have a legacy form field with meta-name 'role' carried over from before the 4.0.3 upgrade, plus email confirmation and open registration enabled. Vulnerable-but-exploitable sites are therefore a subset of installs, pushing this toward targeted or opportunistic-scanning risk rather than guaranteed widespread compromise. Treat as a high-priority patch for any site matching those conditions.

On a vulnerable site (legacy 'role' field present, email confirmation and open registration enabled), an unauthenticated attacker submits the public [wppb-register] shortcode form with role=administrator, which is stored unvalidated into the serialized signup record in wp_signups. The attacker then clicks the confirmation/activation link emailed to their own address, and the activation handler passes the attacker-controlled role directly to WP_User::set_role(), provisioning a fully activated administrator account. No public exploit code was identified at time of analysis, but the attack path is fully described in the Wordfence advisory and plugin source references.