User Profile Builder <=3.16.4 Unauthenticated Auth Bypass & Admin Takeover via Type Confusion (CVE-2026-15826)

Vulnerability Overview Vulnerability Name: User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter CVE ID: CVE-2026-15826 CVSS Score: 9.8 (Critical) Publication Date: August 14, 2026 Last Update Date: August 15, 2026 Researchers: Supakad S. (m3x3) - E-CURITY (Thailand) Affected Range Affected Software: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Affected Versions: <= 3.16.4 Fixed Version: 3.16.5 Remediation Remediation Measures: Upgrade to version 3.16.5 or later patched versions. Vulnerability Description The User Profile Builder plugin, in versions 3.16.4 and earlier, contains an authentication bypass vulnerability. This vulnerability arises from a type confusion issue in the function when calling on the return value of . When a username of 61-70 characters is submitted, the WordPress core rejects it and returns a object. However, forcibly converts this error object to the integer , causing the plugin to return an auto-login token bound to User ID 1. This allows unauthenticated attackers to log in as an administrator and fully take over the website. References plugins.trac.wordpress.org Additional Information Wordfence Interceptions: In the past 24 hours, Wordfence blocked 73 attacks targeting this vulnerability. Related Vulnerabilities: The page lists other recent vulnerabilities in the User Profile Builder plugin, including unauthorized privilege escalation and stored cross-site scripting (XSS). Code Block No specific POC code or exploit code was included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

User Profile Builder <=3.16.4 Unauthenticated Auth Bypass & Admin Takeover via Type Confusion (CVE-2026-15826)

More from this source