Cozmoslabs User Profile Builder

CVE-2026-15826, User Profile Builder: a 61-to-70-character username makes WordPress return an error object, absint() turns it into the integer 1, and the plugin logs the caller in as user ID 1 (CVSS 9.8)

Wordfence disclosed CVE-2026-15826 on 2026-08-14 against the User Profile Builder plugin for WordPress, which carries more than 40,000 active installs: "The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4" (Wordfence Intelligence, 2026-08-14). Switzerland's NCSC bundled it with three other plugin disclosures in an advisory to its own constituency on 2026-08-18 (NCSC-CH Cyber Security Hub, 2026-08-18), which is what brings a 14 August write-up into this window.

The bug is an ordering error, and it is worth reading closely because the class recurs across PHP codebases. The plugin's wppb_log_in_user() function takes the return value of WordPress core's wp_insert_user() and passes it through absint() before testing it with is_wp_error(). Wordfence's description carries the whole chain: "when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1." (Wordfence Intelligence, 2026-08-14) The coercion does not care what kind of value it receives, so the failure path produces a valid-looking user ID of 1 and the plugin proceeds to issue the autologin it would have issued for a successful registration: "This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site." (Wordfence Intelligence, 2026-08-14) A rejected registration becomes an administrator session; the error handling is the vulnerability.

One configuration decides exposure: "The vulnerability is only exploitable on sites where the plugin's Automatically Log In setting is enabled" (Wordfence Intelligence, 2026-08-14). That makes the affected population a subset of the 40,000 installs rather than all of them, and it also supplies the interim control for a site that cannot update immediately, turning the setting off closes the path without removing the plugin. The severity rating does not reflect that gating, which is the usual reason a CVSS 9.8 and a real-world exposure estimate diverge.

The disclosure ran faster than its companion: reported through Wordfence's bug-bounty programme on 2026-07-14 by the researcher credited as Supakiad S. (m3ez), with full disclosure details provided to Cozmoslabs on 2026-07-15; the vendor acknowledged the report on 2026-07-16 and released the fully patched 3.16.5 the same day, and the public write-up followed on 2026-08-14. Wordfence makes no statement about observed exploitation either way, and NCSC-CH records the bundle's exploitation status as unknown. This entry is carried at a lower priority than the Forminator flaw disclosed in the same advisory precisely because of the setting-level precondition and the smaller estate, not because the outcome is milder: an anonymous request reaching the administrator account is as bad as outcomes get on a WordPress site.

Detection has one clean anchor. Because the trigger is a username core will always reject, the attack necessarily leaves a failed-registration attempt with an abnormally long username immediately followed by an authenticated administrator session. In application and access telemetry, the signals are registration submissions carrying usernames in the 61-to-70-character range at all, and any administrator-privileged action whose session began at a registration endpoint rather than at the login form. Triage: genuine registrations produce the same endpoint and the same autologin behaviour on a site that deliberately enables the setting, so the endpoint is not the discriminator; the username length is, since no legitimate registration flow generates 61-to-70-character usernames in volume, and neither does a real user followed by an immediate administrator-level action. Hardening: keep open registration off where it is not needed, and prefer an explicit login step over automatic sign-in after registration, since the automatic path is what converts an error into a session.