More than 40,000 WordPress sites have been exposed to an authentication bypass flaw in the User Profile Builder plugin that can let unauthenticated attackers access the site’s administrator account.
The vulnerability, tracked as CVE-2026-15826 and given a critical CVSS rating of 9.8, affects User Profile Builder versions up to and including 3.16.4.
The flaw can result in full administrative takeover, but exploitation depends on a specific configuration.
Type Confusion Enables Administrator Takeover
The issue stems from a type confusion error in the plugin’s registration and automatic-login flow. Wordfence, a security plugin for WordPress, found that a failed account-creation operation could be converted into an integer before the plugin checked whether the operation had returned an error.
This caused the vulnerable code to treat the result as user ID 1 rather than a failed registration. The automatic-login process could then generate an authentication token associated with that account, allowing an unauthenticated attacker to obtain an administrator session on affected sites.
An attacker who successfully gains administrator access could modify site content, create additional administrator accounts, install malicious plugins or themes and access sensitive information.
However, the described takeover path depends on the site configuration. The administrator must use user ID 1 and automatic login after registration must be enabled, meaning the vulnerability does not present the same critical exploitation path on every installation.
Wordfence received the vulnerability report on July 14 and validated it the following day.
User Profile Builder is developed by Cozmoslabs, which acknowledged the report and released version 3.16.5 on July 16 to address the issue.
For affected site owners, the immediate fix is to update User Profile Builder to version 3.16.5 or later.