Wordfence says a critical authentication bypass in the User Profile Builder WordPress plugin could let unauthenticated attackers log in as a site’s administrator on affected installations, putting more than 40,000 active sites at risk. The issue affects versions up to and including 3.16.4 and was patched in 3.16.5 after responsible disclosure through the Wordfence Bug Bounty Program.
User Profile Builder flaw can hand attackers administrator access
The vulnerability is tracked as CVE-2026-15826 and carries a CVSS score of 9.8, placing it in the critical range. According to Wordfence, it is an unauthenticated authentication bypass caused by a type confusion issue in the plugin’s autologin flow. In the worst case, an attacker can be logged in as user ID 1, which is typically the first administrator account on a WordPress site.
That matters because admin access is effectively full control over the site. Once authenticated as an administrator, a malicious actor can create new admin accounts, install plugins or themes, change content, and potentially exfiltrate sensitive data. Wordfence emphasized that the flaw only becomes exploitable on sites where the plugin’s Automatically Log In after Registration setting is enabled.
How the bug works
User Profile Builder is designed to create custom frontend registration, login, and profile forms for WordPress. In the vulnerable versions, the problem starts when a registration attempt uses a username between 61 and 70 characters. The plugin’s frontend validation accepts usernames in that range, but WordPress core rejects usernames longer than 60 characters and returns a WP_Error object from wp_insert_user().
Wordfence says the plugin mishandles that error during autologin. In wppb_log_in_user(), the code calls absint() on the return value before checking whether it is a WP_Error. That is the key mistake: absint() converts the error object to the integer 1, so the later error check no longer catches the failure. The plugin then treats user ID 1 as a valid account and continues the login process.
From there, the plugin generates a transient-backed autologin nonce for that account and returns a URL containing the nonce. When that URL is followed, the plugin looks up the stored nonce, verifies it, and calls wp_set_auth_cookie() for the bound user ID. In the vulnerable case, that means the attacker can be authenticated as the site administrator.
Why the username length matters
The issue is not triggered by ordinary registrations. It depends on the attacker submitting a username long enough to be rejected by WordPress core but still accepted by the plugin’s own form validation. Wordfence’s analysis notes that a username in the 61-to-70-character range passes the plugin’s checks but causes WordPress core to fail the actual account creation. That mismatch is what creates the error-handling gap.
The result is a classic security bug pattern: the application assumes a successful outcome from a downstream function and keeps going even after the underlying operation failed. In this case, the failure is transformed into a usable integer, allowing the rest of the code to proceed as though a real account had been created.
Patch, disclosure, and timeline
Wordfence says it received the submission on July 14, 2026 from researcher Supakiad S. (m3ez), who reported the issue responsibly through the Wordfence Bug Bounty Program. The researcher received a $975 bounty for the discovery. Wordfence validated the report on July 15 and sent full disclosure details to the vendor the same day through its Vulnerability Management Portal.
The developer, Cozmoslabs, acknowledged the report on July 16, 2026 and released the fully patched version, 3.16.5, on that same day. Wordfence publicly praised the vendor’s response as prompt and timely.
Protection was also rolled out at the firewall layer. Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule on July 15, 2026. Sites using the free version of Wordfence are scheduled to receive the same protection on August 14, 2026.
What site owners should do now
The most important action for site owners is straightforward: update User Profile Builder to the latest patched version immediately. At the time of publication, Wordfence identified 3.16.5 as the fixed release. Because the issue can lead to complete site compromise, delaying the update leaves administrators exposed to takeover attempts.
- Confirm whether User Profile Builder is installed and active on your site.
- Check that the plugin is updated to version 3.16.5 or later.
- Review whether Automatically Log In after Registration is enabled.
- If Wordfence is installed, verify that the relevant firewall protection is active.
- Audit administrator accounts and recent activity if you suspect exposure.
Wordfence also noted an important limitation: the flaw is especially serious when the account with user ID 1 is the site administrator. That is common on many WordPress installs, but not guaranteed. Even so, any site running the vulnerable plugin version with autologin enabled should treat the issue as critical and patch immediately.
Why this vulnerability drew urgent attention
Authentication bypass bugs are among the most dangerous WordPress plugin vulnerabilities because they can erase the usual barrier between the public internet and the admin dashboard. In this case, the attack path does not depend on stolen passwords, social engineering, or access to a logged-in session. It can be launched by an unauthenticated attacker who understands the registration flow and can submit a crafted username.
Wordfence said the bug fits its broader security model of “defense in depth,” combining research, disclosure, and firewall rules to reduce the time between discovery and exploitation. That layered approach is especially relevant for plugin vulnerabilities, where a flaw in a single feature can affect thousands of sites at once.
For users of User Profile Builder, the message is simple: this is a critical update, not a routine maintenance release. Sites that rely on frontend registrations or automatic login should treat the patch as urgent and confirm that the plugin is no longer running any affected version.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: August 15, 2026 at 1:53 am
0 views
