Loading vulnerability…
CVE-2026-15826 is a critical authentication bypass vulnerability in the User Profile Builder plugin for WordPress affecting versions up to and including 3.16.4. The flaw is caused by incorrect type handling in the plugin’s registration and automatic-login flow. Specifically, the wppb_log_in_user() function applies absint() to the return value of wp_insert_user() before verifying whether the return value is a WP_Error via is_wp_error(). When a registration is submitted with a username length that passes the plugin’s frontend validation but is rejected by WordPress core, wp_insert_user() returns a WP_Error object. That object is then coerced by absint() into the integer value 1, causing the plugin to continue execution as though a valid user ID had been returned. The plugin subsequently generates a transient-backed autologin nonce associated with user ID 1, which commonly maps to the original administrator account. An unauthenticated attacker can exploit this logic flaw to obtain an authenticated administrator session and take over the site.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical authentication bypass vulnerability in the WordPress User Profile Builder plugin caused by a type confusion issue in the registration and automatic-login flow, potentially allowing unauthenticated attackers to obtain an administrator session and fully take over affected sites under specific configurations.
An authentication bypass vulnerability caused by type confusion in the WordPress User Profile Builder plugin that can let unauthenticated attackers take over the administrator account.
A critical authentication bypass vulnerability caused by type confusion in the User Profile Builder WordPress plugin's autologin flow. A WP_Error returned by wp_insert_user() can be coerced via absint() into user ID 1, allowing unauthenticated attackers to obtain an autologin nonce and log in as the administrator on affected sites where user ID 1 is an admin.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.