CVE-2026-15826 is an authentication bypass vulnerability in the User Profile Builder plugin for WordPress (up to and including version 3.16.4). The issue arises because the wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a username between 61 and 70 characters, WordPress core rejects it with a WP_Error object. However, absint() coerces this WP_Error object to the integer 1, which corresponds to the Administrator user ID. This causes the plugin to generate and return an autologin nonce tied to user ID 1, enabling unauthenticated attackers to gain full administrative access to the site.

Successful exploitation allows unauthenticated attackers to bypass authentication and log in as the Administrator user (user ID 1), resulting in full administrative takeover of the WordPress site. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user registration or disable the User Profile Builder plugin if possible to mitigate risk.