CVE-2026-109447 cozmoslabs CVE debrief

Who should care

WordPress site administrators and security teams should assess exposure and prioritize remediation to prevent unauthenticated attackers from gaining a fully activated WordPress administrator account. This requires reviewing and updating the User Profile Builder plugin, verifying email confirmation and open user registration settings, and ensuring that legacy form fields with meta-name role are removed.

Why it matters

CVE-2026-109447 is a high-severity Privilege Escalation vulnerability in the User Profile Builder plugin for WordPress. WordPress site administrators and security teams should assess exposure and prioritize remediation to prevent unauthenticated attackers from gaining a fully activated WordPress administrator account.

• Unauthenticated attackers can gain a fully activated WordPress administrator account
• Exploitation requires a legacy form field with meta-name role, email confirmation enabled, and open user registration
• Remediation priority is high due to the potential for privilege escalation

Technical summary

The User Profile Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the role parameter handled by the wppb_add_meta_to_user_on_activation() function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to WP_User::set_role() with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name role to persist and bridge attacker-controlled request input into the serialized signup record stored in wp_signups.

Defensive priority

High

Recommended defensive actions

• Upgrade to a patched version of the User Profile Builder plugin
• Review and remove any legacy form fields with meta-name role
• Verify email confirmation and open user registration settings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability allows unauthenticated attackers to gain a fully activated WordPress administrator account by submitting role=administrator through the public [wppb-register] shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name role carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.