CVE detail
CVE-2026-15826
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 24.0 · diversity 11.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 10
- within the 30d window
- Peak daily
- 9
- highest bucket
Evidence
Source links by recency
10 source links · newest first
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9f606fba-f779-42ea-a160-6c3b20dc5e79?source=cvewww.wordfence.com
No excerpt available.
Patchwww.wordfence.comAug 15, 2026, 7:16 AM - https://plugins.trac.wordpress.org/changeset/3609855/profile-builderplugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 15, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/default-fields/username/username.php#L49plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 15, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/default-fields/username/username.php#L28plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 15, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L945plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 15, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L742plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 15, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L364plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 15, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L262plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 15, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/features/functions.php#L1481plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 15, 2026, 7:16 AM On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder , a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically the site administrator, resulting in full administrative takeover of the site. The vulnerability is only exploitable on sites where the plugin’s Automatically Log In setting is enabled. Props to Supakiad
vendorwww.wordfence.comAug 14, 2026, 6:30 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-53798CVSS 6.9 · Medium
rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned…
- CVE-2026-73429CVSS 5.3 · Medium
Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral…
- CVE-2026-18675CVSS 5.3 · Medium
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runt…
- CVE-2026-6726CVSS 7.9 · High
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aw…
- CVE-2025-51678CVSS 7.5 · High
An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory address can lead to unexpected behavior.
- CVE-2026-50337CVSS 7.8 · High
Incorrect type conversion or cast in Windows Notification allows an authorized attacker to elevate privileges locally.