CVE-2026-15826
Received Received - Intake

Authentication Bypass via Type Confusion in User Profile Builder WordPress Plugin

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: Wordfence

Description
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-15826
EUVD
EUVD-2026-59593

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp-user-avatar profile_builder to 3.16.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-704 The product does not correctly convert an object, resource, or structure from one type to a different type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authentication Bypass via Type Confusion in the User Profile Builder WordPress plugin. It occurs because the wppb_log_in_user() function uses absint() on wp_insert_user()'s return value before checking for errors. When a username of 61-70 characters is submitted, WordPress returns a WP_Error object, but absint() converts it to the integer 1. This causes the plugin to generate an autologin nonce for user ID 1, allowing unauthenticated attackers to log in as the site administrator.

Detection Guidance

This vulnerability can be detected by checking if the User Profile Builder plugin version is 3.16.4 or lower. Inspect the plugin files for the presence of the vulnerable wppb_log_in_user() function and verify if absint() is called before is_wp_error(). Use commands like grep to search for the function in plugin directories.

Impact Analysis

This vulnerability allows unauthenticated attackers to gain full administrative access to a WordPress site by exploiting a type confusion flaw in the User Profile Builder plugin. Attackers can take over the site, modify content, install malicious plugins, steal data, or perform other damaging actions without needing valid credentials.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using this plugin may face compliance violations, legal penalties, reputational damage, and potential data loss if attackers exfiltrate sensitive information.

Mitigation Strategies

Immediately update the User Profile Builder plugin to the latest version beyond 3.16.4. If an update is unavailable, disable or remove the plugin until a patch is released. Review user accounts for unauthorized Administrator access and reset all credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15826. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart