Cozmoslabs User Profile Builder (WordPress, 40,000+ installs) — unauthenticated authentication bypass via type confusion: wppb_log_in_user() calls absint() on the return value of wp_insert_user() before the is_wp_error() check, so a 61-70 character username makes core return a WP_Error that coerces to the integer 1 and the plugin issues an autologin bound to user ID 1. CVSS 9.8, Wordfence as CNA. Exploitable only where the plugin's Automatically Log In setting is enabled. Fixed in 3.16.5 (2026-07-16); write-up 2026-08-14, relayed by NCSC-CH 2026-08-18. No exploitation reported.

CVE-2026-15826 — User Profile Builder: a 61-to-70-character username makes WordPress return an error object, absint() turns it into the integer 1, and the plugin logs the caller in as user ID 1 (CVSS 9.8)

Wordfence disclosed CVE-2026-15826 on 2026-08-14 against the User Profile Builder plugin for WordPress, which carries more than 40,000 active installs: "The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4" (Wordfence Intelligence, 2026-08-14). Switzerland's NCSC bundled it with three other plugin disclosures in an advisory to its own constituency on 2026-08-18 (NCSC-CH Cyber Security Hub, 2026-08-18), which is what brings a 14 August write-up into this window.

The bug is an ordering error, and it is worth reading closely because the class recurs across PHP codebases. The plugin's wppb_log_in_user() function takes the return value of WordPress core's wp_insert_user() and passes it through absint() before testing it with is_wp_error(). Wordfence's description carries the whole chain: "when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1." (Wordfence Intelligence, 2026-08-14) The coercion does not care what kind of value it receives, so the failure path produces a valid-looking user ID of 1 and the plugin proceeds to issue the autologin it would have issued for a successful registration: "This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site." (Wordfence Intelligence, 2026-08-14) A rejected registration becomes an administrator session; the error handling is the vulnerability.

One configuration decides exposure: "The vulnerability is only exploitable on sites where the plugin's Automatically Log In setting is enabled" (Wordfence Intelligence, 2026-08-14). That makes the affected population a subset of the 40,000 installs rather than all of them, and it also supplies the interim control for a site that cannot update immediately — turning the setting off closes the path without removing the plugin. The severity rating does not reflect that gating, which is the usual reason a CVSS 9.8 and a real-world exposure estimate diverge.

The disclosure ran faster than its companion: reported through Wordfence's bug-bounty programme on 2026-07-14 by the researcher credited as Supakiad S. (m3ez), with full disclosure details provided to Cozmoslabs on 2026-07-15; the vendor acknowledged the report on 2026-07-16 and released the fully patched 3.16.5 the same day, and the public write-up followed on 2026-08-14. Wordfence makes no statement about observed exploitation either way, and NCSC-CH records the bundle's exploitation status as unknown. This entry is carried at a lower priority than the Forminator flaw disclosed in the same advisory precisely because of the setting-level precondition and the smaller estate, not because the outcome is milder: an anonymous request reaching the administrator account is as bad as outcomes get on a WordPress site.

Detection has one clean anchor. Because the trigger is a username core will always reject, the attack necessarily leaves a failed-registration attempt with an abnormally long username immediately followed by an authenticated administrator session. In application and access telemetry, the signals are registration submissions carrying usernames in the 61-to-70-character range at all, and any administrator-privileged action whose session began at a registration endpoint rather than at the login form. Triage: genuine registrations produce the same endpoint and the same autologin behaviour on a site that deliberately enables the setting, so the endpoint is not the discriminator — the username length is, since no legitimate registration flow generates 61-to-70-character usernames in volume, and neither does a real user followed by an immediate administrator-level action. Hardening: keep open registration off where it is not needed, and prefer an explicit login step over automatic sign-in after registration, since the automatic path is what converts an error into a session.