A critical authentication bypass vulnerability, identified as CVE-2026-15826, has been discovered in the User Profile Builder plugin for WordPress, potentially exposing over 40,000 websites to administrative takeover. The flaw, which carries a CVSS rating of 9.8, affects plugin versions up to and including 3.16.4.
The vulnerability stems from a type confusion error within the plugin's user registration and automatic-login process. Security researchers at Wordfence, a WordPress security plugin provider, found that if an account creation operation failed, the plugin could incorrectly convert the error result into an integer. This conversion caused the system to interpret the failed operation as a successful registration for user ID 1.
Subsequently, the automatic-login feature would generate an authentication token for this erroneously identified user ID, granting an unauthenticated attacker an administrator session on the affected site. With administrative access, an attacker could alter site content, create additional administrator accounts, install malicious plugins or themes, and access sensitive information.
However, the exploitability of this flaw is contingent on specific site configurations. For a successful administrative takeover, the site must have a user with ID 1 designated as an administrator, and the automatic login after registration feature must be enabled. This means the critical exploitation path does not apply to all installations of the vulnerable plugin.
Wordfence received the vulnerability report on July 14 and confirmed its validity the following day. Cozmoslabs, the developer of User Profile Builder, acknowledged the report and promptly released version 3.16.5 on July 16 to patch the vulnerability. Site owners using the User Profile Builder plugin are strongly advised to update to version 3.16.5 or later immediately to mitigate the risk.
