CVE-2026-15826

Name of the Vulnerable Software and Affected Versions User Profile Builder versions prior to 3.16.5

Description An authentication bypass exists due to type confusion within the wppb log in user() function. When a registration request is submitted using the username parameter with a length between 61 and 70 characters, WordPress core returns a WP Error object. However, the plugin applies the absint() function to this return value before verifying it with is wp error(). This causes the error object to be coerced into the integer 1, leading the plugin to generate an autologin nonce associated with user ID 1. Consequently, unauthenticated attackers can gain full administrative access to the site.

Recommendations Update the plugin to a version newer than 3.16.4.