User Profile Builder Bug Can Hand Out Admin Sessions
Cozmoslabs fixed a critical flaw in User Profile Builder 3.16.5 after Wordfence reported that versions up to 3.16.4 could hand an administrator session to an unauthenticated user on more than 40,000 WordPress sites. The bug is tracked as CVE-2026-15826.
The problem is a type-confusion error in registration plus automatic login: a failed signup can be treated as user ID 1 instead of an error, and the plugin then issues a token for that account. On sites that use automatic login after registration and keep user ID 1 as the admin, that turns a broken form submission into full site control.
That makes this a configuration-gated takeover, not a blanket WordPress risk. If the feature is enabled in your setup, the compromise reaches the admin layer, where an attacker can change content, add admins, and install malicious plugins or themes.