The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in…

CVE-2026-15826 is a type confusion flaw (CWE-704) in the auto-login mechanism of the User Profile Builder WordPress plugin, versions up to and including all 3.x releases before 3.16.5. When a site has the post-registration auto-login feature enabled, an unauthenticated attacker can exploit a type confusion in the login-binding logic to hijack an authenticated session for *any* existing user — including administrators. This gives full WordPress admin access: plugin installation (webshell), database access, and content manipulation. The plugin has approximately 40,000 active installations globally.

The vendor's CVSS 9.8 CRITICAL rating accurately reflects the *technical* impact: unauthenticated, network-accessible, no user interaction, full CIA compromise. However, it overstates real-world risk for most enterprise defenders. The auto-login feature that enables this attack is a non-default configuration — sites that never turned it on are simply not vulnerable. This is the third authentication bypass in this plugin's auto-login flow in 2026 alone (following CVE-2026-15368 fixed in 3.16.4, and CVE-2025-15030 fixed in 3.15.2), which suggests the feature is architecturally fragile but also that the affected population is limited to sites that actively use it. Combined with the relatively small install base of ~40K sites, this is a HIGH-severity issue for affected deployments, not the fleet-wide CRITICAL the CVSS label implies.

Why this verdict

• Non-default prerequisite narrows population: The auto-login feature that exposes the type confusion is not enabled by default. Sites using email confirmation or admin approval workflows — the more common enterprise configuration — are not reachable. This is a compounding downward pressure from the 9.8 baseline.
• Small install base: ~40,000 active installations globally. In an enterprise managing 10,000 hosts, the probability of running this specific plugin is low, but if present, the impact is site-critical.
• Role multiplier: WordPress sites occupy the *typical role* tier (line-of-business web application). They are NOT identity providers, domain controllers, hypervisors, CI/CD, or backup infrastructure. Blast radius is limited to the individual WordPress instance — admin takeover yields control of one site, not domain/fleet compromise. No high-value role floor applies.
• No KEV, no PoC yet: Disclosed today with no confirmed exploitation or public weaponization. However, the prior CVE-2025-15030 in the same plugin was rapidly weaponized, so this grace period is likely short-lived.
• Pattern of fragility: This is the *third* auth bypass in this plugin's auto-login flow in 2026. The code path is architecturally weak, and attackers familiar with CVE-2025-15030 exploitation will recognize the attack surface immediately.

Why not higher?

CRITICAL would require either active exploitation (KEV), a high-value role multiplier with fleet-scale blast radius, or removal of the non-default configuration prerequisite. WordPress with a niche registration plugin is not infrastructure-tier software. The blast radius caps at individual site takeover, not domain or fleet compromise. The non-default auto-login requirement meaningfully reduces the exploitable population below the already-small 40K install base.

Why not lower?

MEDIUM would understate the risk for sites that *do* have auto-login enabled. For those sites, this is an unauthenticated, zero-click, zero-interaction admin takeover on an internet-facing endpoint — the textbook definition of a high-severity web vulnerability. The historical pattern of rapid weaponization for this exact plugin (CVE-2025-15030 mass exploitation) means the window before active exploitation is narrow. Additionally, no authentication or network position is required — any internet user can attempt exploitation.

1. Disable auto-login after registration immediately — Navigate to Profile Builder → Settings → General and disable the automatic login feature. This eliminates the vulnerable code path entirely. This is the fastest mitigation — deploy within the noisgate 30-day mitigation SLA for HIGH, but given the exploitation pattern, do it this week.
2. Update to Profile Builder 3.16.5 or later — The vendor patch is available now. Update via WordPress admin dashboard or WP-CLI (wp plugin update profile-builder). Version 3.16.6 is current and includes additional fixes. Deploy within the noisgate 180-day remediation SLA for HIGH.
3. Restrict registration form access via WAF rules — If you cannot patch or disable auto-login immediately, use your WAF (Cloudflare, Sucuri, Wordfence) to block or rate-limit POST requests to the plugin's registration endpoints. This buys time but is not a complete fix.
4. Enable WordPress admin IP allowlisting — Restrict /wp-admin/ and /wp-login.php access to known admin IPs. Even if an attacker obtains an admin session cookie, they cannot use it if the admin panel is IP-restricted. Most enterprise WordPress deployments should already have this.
5. Audit for compromise indicators — Check WordPress user tables for unexpected admin accounts, review plugin installation logs for unfamiliar plugins, and inspect wp-content/uploads/ for webshells. Use WP-CLI: wp user list --role=administrator to enumerate current admins.

Run this on any host with curl and network access to the target WordPress site. Usage: bash check_profile_builder.sh https://your-wordpress-site.com — no special privileges required, read-only check.

#!/bin/bash
# CVE-2026-15826 - User Profile Builder Type Confusion Auth Bypass Check
# Checks if the target WordPress site runs a vulnerable version of Profile Builder
# Usage: bash check_profile_builder.sh <wordpress_url>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:?Usage: $0 <wordpress_url>}"
TARGET="${TARGET%/}"

echo "[*] Checking User Profile Builder version on $TARGET"

# Method 1: Check readme.txt (most reliable for free plugins)
README=$(curl -sL --max-time 10 "$TARGET/wp-content/plugins/profile-builder/readme.txt" 2>/dev/null || true)

if [ -z "$README" ]; then
  # Method 2: Try via plugin info in page source
  PAGE=$(curl -sL --max-time 10 "$TARGET" 2>/dev/null || true)
  VERSION=$(echo "$PAGE" | grep -oP 'profile-builder[^"]*ver=\K[0-9.]+' | head -1)
  if [ -z "$VERSION" ]; then
    echo "[?] UNKNOWN - Could not detect Profile Builder plugin on $TARGET"
    echo "    Plugin may not be installed, or version detection is blocked."
    exit 2
  fi
else
  VERSION=$(echo "$README" | grep -iP '^Stable tag:\s*' | head -1 | grep -oP '[0-9]+\.[0-9]+\.?[0-9]*')
  if [ -z "$VERSION" ]; then
    echo "[?] UNKNOWN - Found readme.txt but could not parse version"
    exit 2
  fi
fi

echo "[*] Detected Profile Builder version: $VERSION"

# Compare version - vulnerable if < 3.16.5
FIXED="3.16.5"

version_lt() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]
}

if version_lt "$VERSION" "$FIXED"; then
  echo "[!] VULNERABLE - Profile Builder $VERSION is below fixed version $FIXED"
  echo "    CVE-2026-15826: Auth Bypass via Type Confusion in Auto-Login"
  echo "    Action: Update to $FIXED+ and disable auto-login feature immediately"
  exit 0
else
  echo "[+] PATCHED - Profile Builder $VERSION is >= $FIXED"
  exit 1
fi

Sources

1. WPScan – Profile Builder Vulnerabilities
2. Patchstack – Profile Builder Auth Bypass Advisory
3. WordPress.org – User Profile Builder Plugin
4. FreshySites – Profile Builder CVE-2026-3139 Bulletin
5. SicuraNext – Profile Builder Pro Object Injection Research
6. Cozmoslabs – Profile Builder Changelog
7. CYFIRMA – WordPress Auth Bypass Analysis