CVE-2026-15826: fallo crítico en cozmoslabs User Profile Builder – Beautiful…
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
Publicada el · Actualizada el
85Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 3.9%
de la publicación al arma2 días
Publicada en NVD15 ago
1ª PoC+2d
VulnCheck15 ago
probabilidad de explotación
3.9%top 10% de las CVE
explotación observada
síVulnCheck
1 exploit(s) público(s)
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
cozmoslabs · User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role EditorPoCs públicas encontradas — 1
githubgithub.com/HORKimhab/CVE-2026-15826-CVE-2026-15748★ 0⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — cozmoslabs User Profile Builder – Beautiful…
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-0324HIGHUser Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_updateEPSS 2.4%CVE-2023-2297CRITICALProfile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset MechanismEPSS 1.0%CVE-2023-0814MEDIUMProfile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via ShortcodeEPSS 0.8%CVE-2026-6431HIGHUser Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta FieldEPSS 0.4%CVE-2024-12738MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-75964MEDIUMUser Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' ParameterEPSS 0.4%
Referencias
https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/features/functions.php#L1481https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L262https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L364https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L742https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L945https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/default-fields/username/username.php#L28https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/default-fields/username/username.php#L49https://plugins.trac.wordpress.org/changeset/3609855/profile-builderhttps://www.wordfence.com/threat-intel/vulnerabilities/id/9f606fba-f779-42ea-a160-6c3b20dc5e79?source=cve