CVE-2026-15826

CVE-2026-15826 is an unauthenticated authentication bypass caused by type confusion (CWE-704) in the User Profile Builder plugin for WordPress in all versions up to and including 3.16.4. The plugin's wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before checking is_wp_error(); when a registration is submitted with a 61–70 character username, WordPress core returns a WP_Error object, but absint() coerces that object to the integer 1, so the plugin issues an autologin nonce bound to user ID 1 that the attacker can redeem to log in. As a result, an unauthenticated attacker can obtain a session as the site's Administrator account (user ID 1), achieving full administrative takeover of the site. Any WordPress site running the plugin at version 3.16.4 or earlier, with the plugin's registration/autologin flow reachable and user ID 1 holding an Administrator role, is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, though EPSS of 3.9% (90th percentile) suggests a moderate likelihood of exploitation within 30 days.

What to do: Update the User Profile Builder plugin to the latest patched release (any version newer than 3.16.4) as soon as one is available. Until patched, temporarily disable the plugin or at minimum disable its front-end registration form, since the attack is triggered by submitting a registration with an oversized username. Review recent logins and sessions for the user ID 1 Administrator account for unfamiliar IPs or activity, and rotate its credentials if compromise is suspected.