Critical Authentication Bypass in WordPress User Profile Builder Plugin Exposes Admin Accounts
A critical vulnerability in the User Profile Builder WordPress plugin allows unauthenticated attackers to gain administrative access by bypassing authentication, affecting over 40,000 sites.
A critical authentication bypass vulnerability, identified as CVE-2026-15826, has been discovered in the popular User Profile Builder WordPress plugin, potentially exposing administrative accounts on over 40,000 websites. The flaw, present in versions up to 3.16.4, allows unauthenticated attackers to log in as the site administrator (user ID 1) by exploiting a type confusion vulnerability within the plugin's autologin feature. This grants attackers full administrative control over the affected WordPress sites.
The vulnerability is triggered when the 'Automatically Log In' setting within the User Profile Builder plugin is enabled. The exploit hinges on a type confusion flaw in the wppb_log_in_user() function. Specifically, the function attempts to sanitize the return value of wp_insert_user() using absint() before checking if it's a WP_Error object. When a user attempts to register with a username between 61 and 70 characters, WordPress core rejects it with a WP_Error object. However, absint() incorrectly converts this error object to the integer 1. This allows the plugin to proceed as if the user creation was successful and generate an autologin nonce tied to user ID 1, effectively granting administrative access.
Wordfence researchers detailed that the registration form allows usernames up to 70 characters, and the plugin's frontend validation only checks for uniqueness and adherence to WordPress core's validate_username() function. The issue arises because WordPress core itself rejects usernames longer than 60 characters. This discrepancy allows the malformed username to reach wp_insert_user(), leading to the type confusion and subsequent authentication bypass.
Upon discovery, the vulnerability was responsibly reported to the Cozmoslabs team, the developers of User Profile Builder, through the Wordfence Bug Bounty Program. The vendor was notified on July 15, 2026, and promptly acknowledged the report on July 16, 2026. Cozmoslabs released version 3.16.5 on the same day, addressing the critical flaw. Wordfence Premium, Care, and Response users received protection via a firewall rule on July 15, 2026, while free Wordfence users will receive the same protection 30 days later, on August 14, 2026.
The User Profile Builder plugin is widely used for creating custom registration, login, and profile forms on WordPress sites. Its 'Automatically Log In after Registration' feature is designed to streamline the user experience by logging users in immediately after they complete registration. However, this convenience feature became the vector for a critical security compromise.
With a CVSS rating of 9.8 (Critical), the potential impact of this vulnerability is severe, enabling complete site takeover by unauthenticated attackers. The widespread installation base of the plugin means a significant number of websites are at risk if they have not yet updated to the patched version.
Security researchers and vendors strongly urge all users of the User Profile Builder plugin to update immediately to version 3.16.5 or later to mitigate the risk of administrative account compromise. The prompt response from Cozmoslabs has been commended, highlighting the importance of timely patching in the WordPress ecosystem.
This incident underscores the ongoing security challenges within the vast WordPress plugin ecosystem. Vulnerabilities in popular plugins can have far-reaching consequences, emphasizing the need for continuous security research, robust bug bounty programs, and diligent patching by site administrators.