RELEASE EVIDENCE
Check this vendor claim before you install
Quote the claim, name one install, and write the questions the page leaves open.
wordfence.com published this account (2026-10-24): New CVE published by Wordfence (CNA) at 05:17Z. Versions up to and including 4.0.3 let Author-level users create accounts with the Editor role (or any role lacking manage_options/remove_users) because the Register block passes the Assigned Role attribute to [wppb-register] without server-side authorization. Fix referenced in plugin changeset 3741133; WordPress.org lists 4.0.5 (updated 2026-10-19) as current; about 40,000 active installs. Exploitation: NOT STATED. Primary source: OPENED_AND_SUPPORTS. Event time (UTC): 2026-10-24T05:17:06Z. Security record: CVE-2026-115807. Fixed release: https://plugins.trac.wordpress.org/changeset/3741133/profile-builder. Discovery confidence: High.
This guide uses that public page as the example. This site did not run the test, close the deal, or measure the product.
Write only what the page says
The page's claim is: New CVE published by Wordfence (CNA) at 05:17Z. Versions up to and including 4.0.3 let Author-level users create accounts with the Editor role (or any role lacking manage_options/remove_users) because the Register block passes the Assigned Role attribute to [wppb-register] without server-side authorization. Fix referenced in plugin changeset 3741133; WordPress.org lists 4.0.5 (updated 2026-10-19) as current; about 40,000 active installs. Exploitation: NOT STATED. Primary source: OPENED_AND_SUPPORTS. Event time (UTC): 2026-10-24T05:17:06Z. Security record: CVE-2026-115807. Fixed release: https://plugins.trac.wordpress.org/changeset/3741133/profile-builder. Discovery confidence: High.
Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.
Quote the claim, name one install, and write the questions the page leaves open.
Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.
A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.
Stop at the untested line
Anything you did not open, install, or count stays untested. Leave that line visible.
Source page: Profile Builder (WordPress plugin) privilege escalation to Editor via Gutenberg Register block, CVE-2026-115807 (CVSS 7.1).