Cozmoslabs shipped User Profile Builder 3.16.5 this month to close an unauthenticated admin takeover bug now tracked as CVE-2026-15826. The vulnerability was published to the National Vulnerability Database on August 15, 2026, carries a CVSS score of 9.8 (Critical), and affects every version of the plugin up to and including 3.16.4. It hits sites hardest when the “Automatically Log In after Registration” setting is turned on, which is common on membership and community sites built with the plugin.
What the User Profile Builder vulnerability actually does
The bug sits in the plugin’s wppb_log_in_user() function. When a new registration comes in with a username between 61 and 70 characters, WordPress core rejects it and hands back a WP_Error object instead of a user ID. The plugin’s code calls absint() on that return value before checking whether it’s actually an error, and absint() quietly coerces the WP_Error object into the integer 1. Since user ID 1 is very often the original site administrator account, the plugin then generates an autologin nonce bound to that ID and the attacker gets logged in as admin, no credentials required.
According to Wordfence, which credits researcher Supakiad S. (handle m3ez) with the report through its Bug Bounty Program, this is exploitable by anyone who can reach a public registration form, no account needed beforehand. Wordfence’s own writeups put the plugin’s install base above 40,000 active WordPress sites, and User Profile Builder is one Cozmoslabs plugin agencies tend to reach for specifically because it handles front-end registration and login flows.
There’s a wrinkle worth knowing about if you’re deciding how urgently to patch: Cozmoslabs’ own changelog describes 3.16.5 as fixing “an authentication bypass introduced in the latest update,” meaning the bug traces back to an auto-login fix the plugin shipped in version 3.16.4 for a separate issue reported by Jakub Herman through WPScan. The attempted fix opened this new hole. Cozmoslabs has since shipped 3.16.6 as well, with an unrelated fix for an attachment-ownership issue flagged by Patchstack, so the safest move is updating straight to the current release rather than stopping at 3.16.5.
What to do about it
If a site you manage runs User Profile Builder, check the installed version now. Anything at 3.16.4 or earlier needs to move to 3.16.6, not just 3.16.5, since that version carries fixes for two separate issues discovered close together. If the site has “Automatically Log In after Registration” enabled, that’s the configuration Wordfence flags as most exposed, so it’s worth confirming the update actually landed rather than assuming auto-updates caught it.
This is also a good moment to check who holds administrator access on a site using this plugin, since an attacker who lands as user ID 1 through this bug inherits whatever that account can do. If you’re not sure whether a client site is affected or want a second set of eyes on plugin exposure generally, that kind of check is part of what we look at during a WordPress development engagement.
