Loading story…
A critical authentication bypass vulnerability, tracked as CVE-2026-15826, affects the WordPress plugin User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor in versions up to and including 3.16.4. The flaw carries a CVSS 9.8 rating and stems from a type confusion bug in the plugin’s autologin flow: a WP_Error returned by wp_insert_user() can be passed through absint() before error handling, coercing the value to integer 1. An unauthenticated attacker can exploit this by registering with a username between 61 and 70 characters, causing the plugin to generate an autologin nonce for user ID 1, which is commonly the site administrator.
Successful exploitation can result in full administrative takeover of affected WordPress sites, particularly where user ID 1 still belongs to an administrator account. Reports said roughly 40,000 sites were exposed. The issue was patched in 3.16.5, and defenders were urged to update immediately, review administrator accounts for unauthorized access, and verify whether the default administrator mapping to user ID 1 remains in place. Wordfence said firewall protections were released first to paid customers and later to free users.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-15826 was published, describing a critical unauthenticated authentication bypass in the User Profile Builder plugin with a CVSS 9.8 score.
Wordfence made firewall protection for CVE-2026-15826 available to free users, after previously providing it to paid tiers. The vulnerability was reported as affecting roughly 40,000 WordPress sites.
The vendor acknowledged the vulnerability report and released User Profile Builder version 3.16.5 to patch the authentication bypass flaw affecting versions up to 3.16.4.
Wordfence validated the report and confirmed a proof-of-concept exploit, then sent full disclosure details to the vendor through the Wordfence Vulnerability Management Portal. On the same day, Wordfence also distributed a firewall rule to Premium, Care, and Response customers.
Supakiad S. (m3ez) submitted a vulnerability report for the User Profile Builder WordPress plugin through the Wordfence Bug Bounty Program. The issue was later tracked as CVE-2026-15826.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcecvefeed.io
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability, **CVE-2024-10924**, was disclosed and fixed in the WordPress plugin **Really Simple Security**, affecting the Free, Pro, and Pro Multisite editions in versions `9.0.0` through `9.1.1.1`. The flaw carries a **CVSS 9.8** rating and can allow an unauthenticated attacker to log in as any user, including an administrator, on sites where the plugin’s two-factor authentication feature is enabled. The issue was traced to improper error handling in the `check_login_and_get_user` function within the plugin’s two-factor authentication REST API. Defenders warned that roughly **4 million** websites could be exposed, making the bug a high-priority patching issue for WordPress operators. Site owners were urged to update immediately to **version 9.1.2 or later** to close the vulnerability.
Jul 24, 2026
A critical authentication-bypass flaw in the **Burst Statistics** WordPress plugin is being actively exploited to seize administrator access on vulnerable sites. Tracked as `CVE-2026-8181`, the bug affects versions `3.4.0` through `3.4.1.1` and was introduced through improper return-value handling in the plugin’s `is_mainwp_authenticated()` logic for Basic Authentication headers. Security researchers reported that an unauthenticated attacker who knows an administrator username can send arbitrary credentials and be treated as that admin for the request, allowing account impersonation or creation of new administrator accounts on sites running the plugin, which is installed on roughly 200,000 WordPress websites. Wordfence said it observed live attacks and blocked more than 7,400 exploitation attempts in a 24-hour period. Successful compromise could enable follow-on activity including data theft, malware deployment, and malicious site redirection. Defenders were urged to update immediately to **Burst Statistics `3.4.2`** or disable the plugin until patching is possible. Separate disclosures also highlighted another severe WordPress plugin issue, `CVE-2026-6510` in **InfusedWoo Pro** `<= 5.1.2`, where missing authorization checks in the `iwar_save_recipe()` AJAX handler can let unauthenticated attackers craft automation-based authentication bypass leading to administrator-level privilege escalation.
Jun 29, 2026
A critical authentication bypass in the **UpdraftPlus: WP Backup & Migration** WordPress plugin, tracked as `CVE-2026-10795`, is being actively exploited against sites running versions up to and including `1.26.4`. The flaw affects a plugin installed on more than three million WordPress sites and stems from insufficient validation in UpdraftCentral remote procedure call handling, including signature-verification weaknesses and unchecked decryption return values that can collapse to a predictable all-zero key. Wordfence reported blocking **4,987** exploitation attempts in a 24-hour period. Successful exploitation lets unauthenticated attackers impersonate the connected administrator and issue arbitrary RPC actions, including uploading and auto-activating a malicious plugin for **remote code execution** and full site compromise. The vulnerability has been classified under `CWE-347`, with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The issue was reportedly discovered by researcher **vtim**, and the vendor released a patch that adds stricter return-value validation; administrators are being urged to update immediately.
Jun 29, 2026