Authentication Bypass Vulnerability in User Profile Builder Plugin for WordPress
CVE-2026-15826

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Vendor
CVE Published:
15 August 2026

What is CVE-2026-15826?

The User Profile Builder plugin for WordPress faces a significant vulnerability allowing unauthorized users to gain access to site administration. The flaw arises from the plugin's improper handling of user registration submissions with usernames that are 61–70 characters long. Specifically, the wppb_log_in_user() function incorrectly processes WP_Error objects generated by the wp_insert_user() function, converting them to integers through absint() before checking for errors. This logic error enables unauthenticated attackers to receive an autologin nonce linked to user ID 1, effectively allowing them to log in as the site administrator and take full control of the website.

Affected Version(s)

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor 0 <= 3.16.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/profile-builde...
https://plugins.trac.wordpress.org/browser/profile-builde...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supakiad S. (m3ez)
.