{"metadata": {"vulnerability": "CVE-2026-109447", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-08T20:48:40Z", "date_only": false, "value": "2026-10-08T20:48:40.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109447", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-12T16:12:22.990Z", "date_only": false, "value": "2026-10-12T16:12:22.990Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109447", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T16:37:33Z", "date_only": false, "value": "2026-10-15T16:37:33.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109447", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T05:30:24.704Z", "date_only": false, "value": "2026-10-16T05:30:24.704Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109447", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T05:30:24.704Z", "date_only": false, "value": "2026-10-16T05:30:24.704Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109447", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T05:46:11.798Z", "date_only": false, "value": "2026-10-16T05:46:11.798319Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117449003585418491", "record": "CVE-2026-109447", "field": "creation_timestamp", "uuid": "1def7b22-e676-432c-a418-88d8b0371e5d", "content": "CVE-2026-109447 User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register] The User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration \u2014 all stable site-state conditions once established.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109447https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cvehttps://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L262https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400https://plugins.trac.wordpress.org/changeset/3741133/profile-builderhttps://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-confirmation.php#wordpress #cozmoslabs #UserProfileBuilder\u2013BeautifulUserRegistrationForms,UserProfiles&UserRoleEditor#CVE_2026_109447#bot", "url": "https://infosec.exchange/users/cve/statuses/117449003585418491"}, {"timestamp": "2026-10-16T06:17:08Z", "date_only": false, "value": "2026-10-16T06:17:08Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-GQMR-M2RF-7C75", "record": "GHSA-GQMR-M2RF-7C75", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T06:17:08.020Z", "date_only": false, "value": "2026-10-16T06:17:08.020", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109447", "record": "FKIE_CVE-2026-109447", "field": "published"}, {"timestamp": "2026-10-16T06:30:28Z", "date_only": false, "value": "2026-10-16T06:30:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-GQMR-M2RF-7C75", "record": "GHSA-GQMR-M2RF-7C75", "field": "published"}, {"timestamp": "2026-10-16T06:30:28Z", "date_only": false, "value": "2026-10-16T06:30:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-GQMR-M2RF-7C75", "record": "GHSA-GQMR-M2RF-7C75", "field": "modified"}, {"timestamp": "2026-10-16T14:55:57.521Z", "date_only": false, "value": "2026-10-16T14:55:57.521767Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109447", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T14:55:57.521Z", "date_only": false, "value": "2026-10-16T14:55:57.521767Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109447", "record": "FKIE_CVE-2026-109447", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T15:09:38.993Z", "date_only": false, "value": "2026-10-16T15:09:38.993Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109447", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:09:38.993Z", "date_only": false, "value": "2026-10-16T15:09:38.993Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109447", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:17:07.557Z", "date_only": false, "value": "2026-10-16T15:17:07.557", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109447", "record": "FKIE_CVE-2026-109447", "field": "lastModified"}]}