Loading vulnerability…
CVE-2026-15826 is a critical authentication bypass vulnerability in the User Profile Builder plugin for WordPress, affecting versions up to and including 3.16.4. The flaw is caused by incorrect type handling in the plugin's autologin flow. Specifically, the wppb_log_in_user() function applies absint() to the return value of wp_insert_user() before verifying whether that return value is a WP_Error via is_wp_error(). When a registration request uses a username between 61 and 70 characters, WordPress core rejects the username and returns a WP_Error object. Because the plugin coerces that object with absint() before performing error handling, the value becomes integer 1 rather than being treated as an error. Execution then continues as though a valid user ID had been created, causing the plugin to generate and return a transient-backed autologin nonce associated with user ID 1. An unauthenticated attacker can abuse this logic to authenticate as the account mapped to user ID 1, which is commonly the site's original administrator account.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authentication bypass vulnerability caused by type confusion in the WordPress User Profile Builder plugin that can let unauthenticated attackers take over the administrator account.
A critical authentication bypass vulnerability caused by type confusion in the User Profile Builder WordPress plugin's autologin flow. A WP_Error returned by wp_insert_user() can be coerced via absint() into user ID 1, allowing unauthenticated attackers to obtain an autologin nonce and log in as the administrator on affected sites where user ID 1 is an admin.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.