WordPress security changelog
CRITICAL CVE-2026-15826 Deferred

Profile Builder registration type confusion authenticates visitors as user ID 1

Profile Builder through 3.16.4 calls absint() on wp_insert_user() before checking is_wp_error(). A registration using a 61-to-70-character username makes WordPress return WP_Error, which absint() coerces to integer 1; the plugin then issues a transient-backed autologin nonce for user ID 1. An unauthenticated visitor can use that nonce to log in as the first account, normally the site administrator. The public.

CVE / CNA score 9.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Plugin slug
profile-builder
Affected
<= 3.16.4
Safe version
See mitigation notes
Published
Aug 15, 2026
Weakness
CWE-704

This CVE was published Aug 15, 2026 and is one of 29 known issues for this plugin.

What to do

Update, patch or deactivate.

No fixed release is identified in the authoritative record. Update when a confirmed patch is available; until then, disable public Profile Builder registration when warranted and audit administrator logins, sessions, and account changes. The official upstream changelog lists version 4.0.0, which is newer than the published affected range. Its changelog does not clearly confirm this specific fix, so it is not counted as a known-safe release.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources