User Profile Builder WordPress Plugin Vulnerable to Authentication Bypass
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- user profile builder (wordpress)
- Patched version
- Not yet available
The User Profile Builder plugin for WordPress is reportedly vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This vulnerability allows unauthenticated attackers to log in as the site's Administrator account, resulting in full administrative takeover of the site.
What happened
The User Profile Builder plugin for WordPress is under investigation for a critical vulnerability in versions up to, and including, 3.16.4. This vulnerability, tracked as CVE-2026-15826, allows unauthenticated attackers to bypass authentication and log in as the site's Administrator account. This is due to a flaw in the wppb_log_in_user() function, which improperly handles the return value of wp_insert_user(). When a registration is submitted with a 61 to 70 character username, WordPress core rejects it with a WP_Error object. However, the absint() function coerces this object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1.
To assess your exposure, check if your WordPress site is using the User Profile Builder plugin version 3.16.4 or earlier. If so, you are potentially affected by this vulnerability.
What to do about it
- Upgrade the User Profile Builder plugin to a version that fixes the vulnerability as soon as it is available.
- Ensure that usernames on your WordPress site are within the allowed length to mitigate the risk of this specific attack vector.
- Monitor the primary sources for updates on the vulnerability and any official fixes that may be released.
- Consider implementing additional security measures to protect your WordPress site from potential attacks.
How 0Day would have caught this
user profile builder is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if your WordPress site is using the User Profile Builder plugin version 3.16.4 or earlier.
What should I do right now?
Upgrade the User Profile Builder plugin to a version that fixes the vulnerability as soon as it is available and ensure that usernames are within the allowed length.
Is there an official fix available yet?
No official fix has been published yet. Monitor the primary sources for updates.