CVE-2026-15826
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 3.91%
- CWE
- CWE-704
- Published
- 2026-08-15
- Last modified
- 2026-08-17
Affected products
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Weakness type
Related vulnerabilities
- CVE-2026-87546 — Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36...
- CVE-2026-69585 — Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-50278 — iccDEV: CIccEmbedIO::Read8() size_t underflow
- CVE-2026-10080 — Boards plugin panics on WebSocket command with non-string field types
- CVE-2026-53798 — rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping
- CVE-2026-73429 — Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
- CVE-2026-18675 — Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid
- CVE-2026-50337 — Windows Notification Elevation of Privilege Vulnerability