CVE-2026-15826 User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

CVE-2026-15826

The User Profile Builder WordPress plugin (≤ 3.16.4) is vulnerable to unauthenticated authentication bypass via type confusion , rated CVSS 9.8 Critical . The root cause is in wppb_log_in_user(), which calls absint() on the return value of wp_insert_user() before the is_wp_error() check. A regist...

EUVD-2026-59593

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

PT-2026-72877

Name of the Vulnerable Software and Affected Versions User Profile Builder versions prior to 3.16.5 Description An authentication bypass exists due to type confusion within the wppb log in user function. When a registration request is submitted using the username parameter with a length between 6...

40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin

On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder, a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically th...

CVE-2026-66701

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-66701

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

EUVD-2026-53905

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-66701 WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-66701

CVE-2026-66701 affects the WordPress Profile Builder plugin (versions

CVE-2026-66701 WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-15368

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

EUVD-2026-51717

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

CVE-2026-15368

The CVE describes a vulnerability in the WordPress plugin User Profile Builder, affecting versions prior to 3.16.4. The flaw permits an unauthenticated attacker to obtain an authenticated session on an existing user (including administrators) by abusing the automatic login after registration on s...

CVE-2026-15368 Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

CVE-2026-15368

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

EUVD-2026-37608

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-42385

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-42385 WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-42385

The CVE concerns WordPress Profile Builder Pro plugin, versions ≤ 3.15.0, with an Unauthenticated Cross Site Scripting (XSS) vulnerability. The issue affects the plugin’s handling of input in a way that allows an attacker without authentication to inject script resulting in client-side execution....