A type confusion flaw in the User Profile Builder plugin for WordPress (versions ≤ 3.16.4) lets unauthenticated attackers log in as the site Administrator, scoring CVSS 9.8.
What Is It
CVE-2026-15826 is an authentication bypass via type confusion (CWE-704) in the wppb_log_in_user() function. The function calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress core rejects it and returns a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution. The plugin then binds and returns a transient-backed autologin nonce tied to user ID 1.
Why It Matters
User ID 1 is the site's original Administrator account on a default WordPress install. The result is full administrative takeover triggered by nothing more than a crafted registration submission. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability. Exploitability scores the maximum 3.9. Any site running the plugin with front-end registration exposed is reachable by an anonymous attacker.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: cozmoslabs
- Product: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (WordPress plugin)
- Affected versions: all versions up to and including 3.16.4
Patch Status
A fix was committed to the plugin repository in changeset 3609855. The supplied data does not name a fixed release version, and no CISA-mandated remediation deadline applies since the CVE is not listed in KEV. Operators should update the plugin to the latest available release from the vendor.
Sources
- NVD, CVE-2026-15826 record (source: [email protected]), published 2026-08-15
- Wordfence Threat Intel entry
- WordPress Plugin Trac; changeset 3609855 (fix)
- Vulnerable code; functions.php L1481
- Vulnerable code; class-formbuilder.php L262
- Vulnerable code; username.php L28