CVE-2026-15826: critical vulnerability in cozmoslabs User Profile Builder – Beautiful…
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
Published · Updated
85Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 3.9%
from disclosure to weapon2 days
Published on NVDAug 15
1st PoC+2d
VulnCheckAug 15
exploitation probability
3.9%top 10% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
cozmoslabs · User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editorpublic PoCs found — 1
githubgithub.com/HORKimhab/CVE-2026-15826-CVE-2026-15748★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — cozmoslabs User Profile Builder – Beautiful…
In the same product, most dangerous first.
CVE-2024-0324HIGHUser Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_updateEPSS 2.4%CVE-2023-2297CRITICALProfile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset MechanismEPSS 1.0%CVE-2023-0814MEDIUMProfile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via ShortcodeEPSS 0.8%CVE-2026-6431HIGHUser Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta FieldEPSS 0.4%CVE-2024-12738MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-75964MEDIUMUser Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' ParameterEPSS 0.4%
References
https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/features/functions.php#L1481https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L262https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L364https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L742https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L945https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/default-fields/username/username.php#L28https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/default-fields/username/username.php#L49https://plugins.trac.wordpress.org/changeset/3609855/profile-builderhttps://www.wordfence.com/threat-intel/vulnerabilities/id/9f606fba-f779-42ea-a160-6c3b20dc5e79?source=cve