---
id: CVE-2026-15826
title: >-
  The User Profile Builder plugin for WordPress is vulnerable to Authentication
  Bypass via Type Confusion in versions up to, and including, 3.16.4
summary: >-
  The User Profile Builder plugin for WordPress is vulnerable to Authentication
  Bypass via Type Confusion in versions up to, and including, 3.16.4. This is
  due to the wppb_log_in_user() function calling absint() on the return value of
  wp_i…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-704
published: '2026-08-15'
updated: '2026-08-15'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15826'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/features/functions.php#L1481
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L262
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L364
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L742
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L945
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/default-fields/username/username.php#L28
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/default-fields/username/username.php#L49
    label: security@wordfence.com
  - url: 'https://plugins.trac.wordpress.org/changeset/3609855/profile-builder'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/9f606fba-f779-42ea-a160-6c3b20dc5e79?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - exploit-available
epss: 0.03911
epssPercentile: 0.89863
ingestedAt: '2026-08-16T06:35:00.164Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/HORKimhab/CVE-2026-15826-CVE-2026-15748'
  nuclei:
    - CVE-2026-15826
  checkedAt: '2026-09-21T15:28:07.471Z'
exploitAvailable: true
---

## Overview

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.