CVE-2026-15826 User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

CVE-2026-15826

creationtimestamp| type| source ---|---|--- 2026-08-15 04:04:23+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mt3s65m3s72u 2026-08-15 07:30:23+00:00| seen| https://infosec.exchange/users/offseq/statuses/117098350030600158 2026-08-15 07:30:25+00:00| seen|...