CVE-2026-15826— User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| cozmoslabs | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | ≤ 3.16.4 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-15826
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不正确的类型转换
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| cozmoslabs | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 0 ~ 3.16.4 | - |
II. Public POCs for CVE-2026-15826
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15826
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-15826 (2)
Other References for CVE-2026-15826 (1)
IV. Related Vulnerabilities
Same product: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- CVE-2026-3139
User Profile Builder – Beautiful User Registration Forms, Us - CVE-2025-13054
User Profile Builder – Beautiful User Registration Forms, Us - CVE-2025-8896
User Profile Builder – Beautiful User Registration Forms, Us - CVE-2025-4671
Profile Builder <= 3.13.8 - Authenticated (Contributor+) Sto - CVE-2025-2314
User Profile Builder – Beautiful User Registration Forms, Us
Same vendor: cozmoslabs
- CVE-2026-66701
WordPress Profile Builder plugin <= 3.16.5 - Broken Access C - CVE-2026-18510
TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site - CVE-2026-17505
TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting - CVE-2026-59539
WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecu - CVE-2026-61971
WordPress User Profile Picture plugin <= 2.6.3 - Insecure Di
Same weakness: CWE-704
- CVE-2026-53798
rsync < 3.5.0 Privilege Confusion via name-converter uid/gid - CVE-2026-73429
Russh: client wrong-length X25519 `clone_from_slice` panic ( - CVE-2026-50337
Windows Notification Elevation of Privilege Vulnerability - CVE-2026-59871
node-tar: Process crash via PAX numeric path type confusion - CVE-2026-48140
Unchecked enum cast vulnerability in NI grpc-device in Begin
V. Comments for CVE-2026-15826
No comments yet