Description

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T07:16:19.280Z",
  "pubdate": "2026-08-15T07:16:19.280Z",
  "executiveSummary": "The User Profile Builder plugin for WordPress is vulnerable to an Authentication Bypass via Type Confusion, specifically residing in the wppb_log_in_user() function. This critical security flaw affects versions up to, and including, 3.16.4.\nThe vulnerability allows unauthenticated attackers to achieve full administrative takeover of a target WordPress site by successfully logging in as the site's primary Administrator account, typically associated with user ID 1.\nThe root cause stems from improper handling of return values and type coercion within the plugin's registration and authentication logic, where a WordPress error object is mishandled before an error validation check can execute.\nExploitation requires no prior authentication or elevated privileges, making it accessible to remote attackers over the network. Successful exploitation grants complete administrative control, posing catastrophic risks to the confidentiality, integrity, and availability of the affected system.\nMitigation requires updating the User Profile Builder plugin to a patched version beyond 3.16.4 as soon as it becomes available, or applying relevant vendor-supplied patches to remediate the type confusion condition.",
  "technicalDetails": "The vulnerability is caused by a Type Confusion flaw within the wppb_log_in_user() function of the User Profile Builder plugin, affecting versions 3.16.4 and prior. The vulnerable component is responsible for handling user registration processes and automatically logging users in upon successful submission.\nThe exact root cause involves improper function execution order and data type handling when evaluating the return value of WordPress core functions. Specifically, the wppb_log_in_user() function calls absint() on the return value of wp_insert_user() prior to executing an is_wp_error() check.\nDuring standard registration operations, when an unauthenticated user submits a registration request containing a username between 61 and 70 characters in length, WordPress core rejects the request and returns a WP_Error object. However, because the plugin passes this return value directly into absint() before validating it with is_wp_error(), the PHP integer casting function coerces the WP_Error object into the integer 1.\nThis premature type coercion alters the expected execution flow by preventing the subsequent is_wp_error() conditional check from correctly identifying the failure and short-circuiting execution. As a result, the application proceeds as if the registration successfully generated a valid user ID corresponding to the integer 1.\nConsequently, the plugin binds and returns a transient-backed autologin nonce specifically tied to user ID 1, which represents the site's primary Administrator account. Unauthenticated attackers can leverage this behavior over the network to bypass standard authentication mechanisms entirely.\nPost-exploitation impact includes full administrative takeover of the WordPress site, allowing attackers to execute arbitrary code, modify site content, create backdoor administrator accounts, and compromise underlying server resources."
}