Security Alert Summary
The User Profile Builder plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-15826) that can allow an unauthenticated attacker to obtain an autologin nonce bound to user ID 1. In vulnerable versions, a type confusion between core and plugin code can cause the plugin to treat a WP_Error object as an integer, enabling an attacker to log in as the site Administrator.
CVE Details
- CVE ID: CVE-2026-15826
- Affected plugin / component: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Affected versions: Versions up to, and including, 3.16.4
- Published: August 15, 2026 at 7:16:19 AM UTC
- Last modified: August 15, 2026 at 7:16:19 AM UTC
- CVSS v3.1 base score / severity / vector: 9.8 / CRITICAL /
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: No authentication required; privileges required: NONE; user interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness (CWE): CWE-704
Technical Details
The vulnerability is a type confusion in the plugin’s login path. The plugin calls wppb_log_in_user(), which in turn calls wp_insert_user() and immediately passes its return value to absint() before checking for errors with is_wp_error(). When a registration is submitted with a username between 61 and 70 characters, WordPress core returns a WP_Error object. Passing that object to absint() coerces it to the integer 1, allowing execution to continue past the error check.
Because the plugin then binds and returns a transient-backed autologin nonce tied to user ID 1, an unauthenticated attacker can receive an autologin token associated with the Administrator account (user ID 1) and use it to authenticate as that user. The immediate cause is the missing or misordered error handling: absint() is applied before the is_wp_error() check, producing incorrect type coercion and bypassing the intended short-circuit logic.
How This Could Impact Your Website
In a realistic scenario, an external attacker could submit a specially crafted registration form with a long username and receive an autologin nonce that grants access as the site Administrator. From there an attacker with Administrator privileges can view and export user details, change site content, install plugins or backdoors, and alter configuration settings.
For sites with multiple users, the consequences include exposure of internal user email addresses and other user data, increased risk of targeted phishing or social engineering against staff or contractors, and the potential for destructive changes or persistent backdoors that affect availability and integrity. If you reassign or grant elevated roles to outside contractors or contributors, the risk from a successful exploit is greater.
professional review If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level or higher accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from the site.
- Monitor site activity and logs for unusual behavior, including unexpected admin logins and new transient values.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/features/functions.php#L1481
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L262
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L364
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L742
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L945
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/default-fields/username/username.php#L28
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/default-fields/username/username.php#L49
- https://plugins.trac.wordpress.org/changeset/3609855/profile-builder
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9f606fba-f779-42ea-a160-6c3b20dc5e79?source=cve
