What is CVE-2026-15826?
An Authentication Bypass via Type Confusion vulnerability exists in the User Profile Builder plugin for WordPress up to version 3.16.4. The issue stems from the wppb_log_in_user() function improperly using absint() on the return value of wp_insert_user() before an is_wp_error() check, potentially allowing unauthorized access. Users should update the plugin to the latest patched version immediately.
Azərbaycanca: User Profile Builder WordPress plaginində (3.16.4-ə qədər versiyalarda) Type Confusion zəifliyi aşkarlanıb. Bu, wppb_log_in_user() funksiyasında wp_insert_user() nəticəsinin səhvən absint() ilə işlənməsi səbəbindən autentifikasiyadan yan keçməyə imkan verir. İstifadəçilər plagini ən son versiyaya yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-287
FAQ2
What versions of the User Profile Builder plugin does CVE-2026-15826 affect?
This vulnerability affects all versions of the plugin up to 3.16.4.
How does this Authentication Bypass vulnerability occur technically?
The vulnerability occurs due to Type Confusion in the wppb_log_in_user() function, where the return value of wp_insert_user() is improperly processed with absint() before an is_wp_error() check.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.