Cozmoslabs User Profile Builder Plugin up to 3.16.4 on WordPress wppb_log_in_user type confusion

Summaryinfo

A vulnerability has been found in Cozmoslabs User Profile Builder Plugin up to 3.16.4 and classified as critical. Affected by this issue is the function wppb_log_in_user. The manipulation leads to type confusion. This vulnerability is documented as CVE-2026-15826. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Cozmoslabs User Profile Builder Plugin up to 3.16.4 and classified as critical. This issue affects the function wppb_log_in_user. The manipulation with an unknown input leads to a type confusion vulnerability. Using CWE to declare the problem leads to CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.

The advisory is shared at wordfence.com. The identification of this vulnerability is CVE-2026-15826 since 07/15/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/15/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• Cozmoslabs

Name

• User Profile Builder Plugin

Version

• 3.16.0
• 3.16.1
• 3.16.2
• 3.16.3
• 3.16.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion