AI description
CVE-2026-15826 is an authentication bypass vulnerability found in the User Profile Builder plugin for WordPress, affecting versions up to and including 3.16.4. This flaw allows unauthenticated attackers to log in as a site's administrator. The vulnerability stems from a bug within the plugin's registration and autologin process, specifically related to how WordPress core handles usernames exceeding 60 characters. Discovered by security researcher Supakiad S. (m3ez) and reported via Wordfence's Bug Bounty Program, this issue impacts over 40,000 WordPress sites, particularly those with the "Automatically Log In after Registration" setting enabled. A fix for this vulnerability is included in User Profile Builder version 3.16.5.
- Description
- The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
- Source
- security@wordfence.com
- NVD status
- Received
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- security@wordfence.com
- CWE-704
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
21
40,000 #WordPress Sites affected by Authentication Bypass #Vulnerability in User Profile Builder #WordPressPlugin #⃣CVSS Rating: 9.8 (Critical) 🆔CVE-ID: CVE-2026-15826 🎯Affected Version(s): <= 3.16.4 ✅Patched Version: 3.16.5 https://t.co/mt6xLev84B
@webknitdigital
15 Aug 2026
5 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 CRITICAL: CVE-2026-15826 (CVSS 9.8) allows unauthenticated attackers to bypass authentication and take over WordPress administrator accounts. The flaw affects User Profile Builder ≤ 3.16.4, putting 40,000+ sites at risk. The issue is fixed in 3.16.5. Update immediately.
@ThreatWire_
15 Aug 2026
18903 Impressions
25 Retweets
107 Likes
57 Bookmarks
2 Replies
1 Quote