User Profile Builder type-confusion auth bypass enables admin account takeover (CVE-2026-15826)
VulnCheck added this CVSS 9.8 unauthenticated auth bypass to its KEV catalog with Wordfence reporting exploitation, and sites still on 3.16.4 or earlier can be taken over as administrator this week.
The plugin's wppb_log_in_user() coerces a WP_Error from wp_insert_user() to integer 1 via absint() before the error check, so a registration submitted with a 61–70 character username causes the plugin to issue an autologin nonce bound to user ID 1 — typically the site administrator. An unauthenticated attacker can use this to log in as admin and fully take over the site.
Affected: cozmoslabs User Profile Builder (profile-builder) <= 3.16.4
How to Test
Check the installed plugin version in wp-admin → Plugins or via `wp plugin get profile-builder`; anything at or below 3.16.4 is vulnerable. Review access logs for registration form POSTs containing 61–70 character usernames, and audit wp_users for unexpected recent logins or sessions on user ID 1 and any newly created administrator accounts.
How to Patch
Update the profile-builder plugin to the first release after 3.16.4 (via wp-admin or `wp plugin update profile-builder`). If you cannot update immediately, disable public registration through the plugin's forms or deactivate the plugin, and rotate administrator credentials and sessions if you find suspicious autologin activity.