---
schema: 1
kind: vulnerability
title: "CVE-2026-15826 — User Profile Builder: a 61-to-70-character username makes WordPress return an error object, absint() turns it into the integer 1, and the plugin logs the caller in as user ID 1 (CVSS 9.8)"
headline: "A type coercion in the wrong order hands an anonymous registrant the administrator account"
summary: >
  Wordfence disclosed CVE-2026-15826 on 2026-08-14, an unauthenticated authentication bypass in the User
  Profile Builder plugin for WordPress affecting all versions up to and including 3.16.4 — 40,000+ active
  installs, CVSS 9.8, Wordfence as CVE Naming Authority. The plugin's wppb_log_in_user() function calls
  absint() on the return value of wp_insert_user() before checking whether that value is an error: a
  registration with a 61-to-70-character username is rejected by WordPress core with a WP_Error object, which
  absint() coerces to the integer 1 before the error check can stop execution, so the plugin issues an
  autologin bound to user ID 1 — normally the site administrator. Exploitable only where the plugin's
  Automatically Log In setting is enabled. Patched in 3.16.5 on 2026-07-16, the same day the vendor acknowledged the report; no source reports observed exploitation.
discovered_at: "2026-08-19T05:28:00Z"
event_date: "2026-08-14"
run_id: 2026-08-19T0410Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, auth-bypass, pre-auth, identity, patch-available]
regions: [global, europe, switzerland]
sectors: [public-sector, education, technology]
entities: []
techniques: [T1190, T1078.003]
affected_products: ["Cozmoslabs User Profile Builder"]
cves:
  - id: CVE-2026-15826
    cvss: "9.8"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "User Profile Builder ≤ 3.16.4, and only where the plugin's Automatically Log In setting is enabled"
    fixed: "3.16.5 (released 2026-07-16)"
sources:
  - url: "https://security-hub.ncsc.admin.ch/#/posts/12860"
    publisher: "NCSC-CH Cyber Security Hub"
    date: "2026-08-18"
    role: primary
  - url: "https://malware.news/t/40-000-wordpress-sites-affected-by-authentication-bypass-vulnerability-in-user-profile-builder-wordpress-plugin/124811"
    publisher: "malware.news (verbatim syndication of the Wordfence Intelligence post)"
    date: "2026-08-14"
    role: corroborating
  - url: "https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html"
    publisher: "The Hacker News (quoting Wordfence)"
    date: "2026-08-17"
    role: corroborating
closed_sources: []
evidence:
  - quote: "The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4."
    publisher: "Wordfence Intelligence"
  - quote: "when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1."
    publisher: "Wordfence Intelligence"
  - quote: "The vulnerability is only exploitable on sites where the plugin’s Automatically Log In setting is enabled."
    publisher: "Wordfence Intelligence"
  - quote: "This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site."
    publisher: "Wordfence Intelligence"
verification: multi-source
sourcing_note: >
  As with the companion Forminator disclosure, Wordfence is the single assessor — bug-bounty programme
  operator and CVE Naming Authority — and wordfence.com refused every transport available this run, so its
  text is quoted from a feed that reproduces the post verbatim and cross-checked against the CVE description
  Wordfence supplied as CNA. NCSC-CH is cited as primary because it is the national authority that put the
  disclosure in front of this constituency, in a bundle whose exploitation status it records as unknown.
  Credibility is 2 rather than 1: the additional publishers relay one assessor rather than independently
  confirm it. Every quoted passage was literal-substring-checked against the retrieved copy before
  composition; the plugin's fixed release was additionally confirmed present in the official WordPress.org
  plugin release history.
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Update User Profile Builder to 3.16.5 or later; where that cannot be done immediately, disable the plugin's Automatically Log In setting, which Wordfence states is the precondition for exploitability."
  - "On any affected site that allowed open registration while unpatched, review the administrator account (user ID 1) for sessions, password changes or content changes that do not correspond to a known administrator login."
migrated_from: null
---

Wordfence disclosed CVE-2026-15826 on 2026-08-14 against the User Profile Builder plugin for WordPress, which carries more than 40,000 active installs: "The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4" ([Wordfence Intelligence, 2026-08-14](https://malware.news/t/40-000-wordpress-sites-affected-by-authentication-bypass-vulnerability-in-user-profile-builder-wordpress-plugin/124811)). Switzerland's NCSC bundled it with three other plugin disclosures in an advisory to its own constituency on 2026-08-18 ([NCSC-CH Cyber Security Hub, 2026-08-18](https://security-hub.ncsc.admin.ch/#/posts/12860)), which is what brings a 14 August write-up into this window.

The bug is an ordering error, and it is worth reading closely because the class recurs across PHP codebases. The plugin's `wppb_log_in_user()` function takes the return value of WordPress core's `wp_insert_user()` and passes it through `absint()` *before* testing it with `is_wp_error()`. Wordfence's description carries the whole chain: "when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1." ([Wordfence Intelligence, 2026-08-14](https://malware.news/t/40-000-wordpress-sites-affected-by-authentication-bypass-vulnerability-in-user-profile-builder-wordpress-plugin/124811)) The coercion does not care what kind of value it receives, so the failure path produces a valid-looking user ID of 1 and the plugin proceeds to issue the autologin it would have issued for a successful registration: "This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site." ([Wordfence Intelligence, 2026-08-14](https://malware.news/t/40-000-wordpress-sites-affected-by-authentication-bypass-vulnerability-in-user-profile-builder-wordpress-plugin/124811)) A rejected registration becomes an administrator session; the error handling is the vulnerability.

One configuration decides exposure: "The vulnerability is only exploitable on sites where the plugin's Automatically Log In setting is enabled" ([Wordfence Intelligence, 2026-08-14](https://malware.news/t/40-000-wordpress-sites-affected-by-authentication-bypass-vulnerability-in-user-profile-builder-wordpress-plugin/124811)). That makes the affected population a subset of the 40,000 installs rather than all of them, and it also supplies the interim control for a site that cannot update immediately — turning the setting off closes the path without removing the plugin. The severity rating does not reflect that gating, which is the usual reason a CVSS 9.8 and a real-world exposure estimate diverge.

The disclosure ran faster than its companion: reported through Wordfence's bug-bounty programme on 2026-07-14 by the researcher credited as Supakiad S. (m3ez), with full disclosure details provided to Cozmoslabs on 2026-07-15; the vendor acknowledged the report on 2026-07-16 and released the fully patched 3.16.5 the same day, and the public write-up followed on 2026-08-14. Wordfence makes no statement about observed exploitation either way, and NCSC-CH records the bundle's exploitation status as unknown. This entry is carried at a lower priority than the Forminator flaw disclosed in the same advisory precisely because of the setting-level precondition and the smaller estate, not because the outcome is milder: an anonymous request reaching the administrator account is as bad as outcomes get on a WordPress site.

Detection has one clean anchor. Because the trigger is a username core will always reject, the attack necessarily leaves a failed-registration attempt with an abnormally long username immediately followed by an authenticated administrator session. In application and access telemetry, the signals are registration submissions carrying usernames in the 61-to-70-character range at all, and any administrator-privileged action whose session began at a registration endpoint rather than at the login form. **Triage:** genuine registrations produce the same endpoint and the same autologin behaviour on a site that deliberately enables the setting, so the endpoint is not the discriminator — the username length is, since no legitimate registration flow generates 61-to-70-character usernames in volume, and neither does a real user followed by an immediate administrator-level action. Hardening: keep open registration off where it is not needed, and prefer an explicit login step over automatic sign-in after registration, since the automatic path is what converts an error into a session.