PatchTheCVECVE-2026-15826: The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in ver
CVE-2026-15826 is a critical-severity flaw (CVSS 9.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the i
Why this priority
- Critical severity
- EPSS top 10%: very likely to be exploited
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 3.9% (top 10%) |
| CISA exploited list | No |
| Weakness | CWE-704 |
| Published | 2026-08-15 |
| Last modified | 2026-08-20 |
Last updated 2026-08-20 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: HORKimhab/CVE-2026-15826-CVE-2026-15748 (0 stars)
- Nuclei scan template: User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-15826?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-15826 being exploited?
CVE-2026-15826 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-15826 affect?
CVE-2026-15826 affects affected software. Severity is critical (CVSS 9.8). The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_inse
How urgent is CVE-2026-15826?
Priority 62/100. Critical severity; EPSS top 10%: very likely to be exploited; Remotely exploitable, no login, no user action