Security Brief: User Profile Builder Authentication Bypass

Wordfence reported an auth bypass in User Profile Builder (about 40,000 installs). Older releases can auto-login as the first WordPress user. Update, review admins, and recheck the public stack.

Back to Blog

Illustration of a security alert regarding WordPress user profile vulnerability.

Wordfence published an alert covering User Profile Builder, the Cozmoslabs plugin that adds front-end registration, profiles, and role editing to WordPress. Their headline cites about 40,000 sites. Older releases can hand an administrator session to someone who never knew the admin password. If the plugin is installed, update it this week and review who can sign in as an administrator.

What happened

Public records track this as CVE-2026-15826. Wordfence scored it CVSS 9.8 (Critical). The National Vulnerability Database published the CVE on 15 August 2026. Affected software is User Profile Builder through version 3.16.4. The plugin also appears in dashboards as Profile Builder. The wordpress.org slug is profile-builder. As of late August 2026 the directory listed a current 4.x release, so you should install whatever the vendor shows as latest, not a one-off 3.16.5 screenshot from an advisory.

The flaw lives on the automatic-login-after-register path. After a visitor submits the plugin's registration form, WordPress core may refuse to create the account. The plugin still converted that failure into a numeric user ID before it asked whether creation had succeeded. In PHP, turning a failure object into a number can produce 1. User ID 1 is the first account WordPress creates. On a typical site that account is still an administrator, even if you later renamed the display name.

The plugin then minted an automatic-login token for that ID. A visitor who never held an account could therefore receive an administrator session. No stolen password is required. That is why the score is critical: the request is unauthenticated, and the outcome can be full control of wp-admin.

Cozmoslabs changed the check order so a failed registration cannot be treated as a successful login. That repair shipped in 3.16.5. Later 3.x and 4.x builds include it. Open Plugins, find the Cozmoslabs plugin, and compare the version string to wordpress.org. Do not assume a host-level auto-update already applied it.

This brief is for site owners. It does not walk through the registration input that triggers the failure. For the technical write-up, use the Wordfence post and the NVD record in Sources.

Why it matters for website owners

You are in scope if the plugin is installed, including sites that only used it for profile pages and later turned registration on. Membership, directory, course, and community sites that collect signups on the front end are the obvious cases. A brochure site with a leftover registration form from a cancelled membership project is still in scope.

An unexpected administrator can install more plugins, edit theme files, create extra admin users, and plant persistence that survives the plugin update. Patching without a user review leaves that door half closed. The 40,000 figure is an install estimate from the Wordfence headline, not a confirmed count of compromised sites. Treat it as a reason to inventory, not as proof that you were already hit.

If someone already renamed or demoted user ID 1, the same class of bug can still bind a session to whichever account sits at that ID. Look up user 1 in the database or in a user plugin that shows IDs, then decide whether that account should remain an administrator at all.

Automatic login after registration is a convenience setting. If you never meant to offer public signup, turning that off reduces exposure while you patch. It is not a substitute for updating the plugin. Another administrator can turn the form back on, and leftover shortcodes still render on forgotten pages.

What to check on your site

  • In Plugins, find User Profile Builder or Profile Builder by Cozmoslabs. Update to the latest wordpress.org release (patched from 3.16.5 onward). If you cannot update today, turn off automatic login after registration and pause public registration until you can.
  • Open Users. Look for administrators you did not create, new email addresses, and unexplained last-login times. Reset the owner password if anything looks off. Confirm which account is user ID 1.
  • After you patch, run a public WordPress profile with the WordPress Stack Checker to see leftover plugin and admin-surface clues on the hostname you own.
  • If you manage more than one WordPress site, start with the WordPress Vulnerability Scanner to fingerprint public CMS details before you open each dashboard.
  • If takeover looks likely, scan URLs you authorize with the Website Vulnerability Scanner, then inspect plugins, themes, and uploads for files you did not place.

Related reading

Sources