CVE-2026-15826: User Profile Builder Bug Under Active Attack, Grants Full Admin Takeover (CVSS 9.8)
Do Son 
TL;DR: A critical User Profile Builder vulnerability, carrying a maximum CVSS score of 9.8 and tracked as CVE-2026-15826, now threatens more than 40,000 WordPress sites. It lets unauthenticated attackers log straight in as a site’s administrator. Wordfence’s firewall has already blocked 13 real attacks against the bug in the past 24 hours.
Running Infra, AppSec, and SOC teams? Tag WordPress alerts by team automatically.
Try Team free for 14 days
Why It Matters
User Profile Builder powers custom registration, login, and profile forms on more than 40,000 WordPress sites. This bug puts full administrative control up for grabs. Once attackers reach the dashboard, they can create rogue admin accounts, install a backdoor plugin, or siphon customer data. Attackers could also plant persistent backdoors that survive a plugin update. Similarly, they can rewrite site content or redirect visitors to malicious pages. The attack requires no valid credentials, so any site running the plugin’s Automatically Log In setting stays at risk.
Security researcher Supakiad S., known online as m3ez, found and privately reported the flaw through Wordfence’s Bug Bounty Program. As a result, Wordfence built firewall protection before the vulnerability became public knowledge.
How the Attack Works
This User Profile Builder vulnerability sits inside the plugin’s registration and autologin flow. WordPress core rejects any username longer than 60 characters and returns an error object instead. A 61-to-70 character username passes the plugin’s own checks but fails WordPress core’s limit, triggering the flaw. However, the plugin’s own function calls PHP’s absint() on that error object before checking whether an error occurred. That call converts the error into the number 1, which happens to match the site’s original administrator ID.
As a result, the plugin treats the failed registration as a successful login for user ID 1. It then generates a valid autologin link tied to that same ID. Anyone who follows the link signs in as the administrator, without supplying a password.
Affected Versions
The vulnerability affects User Profile Builder through version 3.16.4. WordPress.org’s plugin listing shows more than 40,000 active installs. Version 3.16.5 contains the fix. The plugin remains widely used by membership sites, online communities, and course platforms. Sites only face risk when the plugin’s Automatically Log In after Registration setting stays enabled, Wordfence’s advisory notes.
Patch and Mitigation Steps
Site owners should update User Profile Builder to version 3.16.5 right away. This single update closes the User Profile Builder vulnerability completely. Administrators who cannot update immediately should turn off the Automatically Log In after Registration setting instead. That step alone blocks the attack path, even on outdated installs. Site owners should also review admin accounts for any unfamiliar logins created before the patch. Logging tools can help confirm whether an attacker already exploited the bug.
Wordfence’s advisory urges affected users to apply the patched release “as soon as possible.”
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
