The User Profile Builder WordPress plugin is vulnerable to an authentication bypass via type confusion in versions up to 3.16.4. The vulnerability occurs in the wppb_log_in_user() function, which calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress core returns a WP_Error object, but absint() coerces this object to the integer 1 before the error check can prevent further execution. Consequently, the plugin binds and returns an autologin nonce tied to user ID 1 (the administrator), enabling unauthenticated attackers to log in as the site administrator and gain full administrative access.

An unauthenticated attacker can bypass authentication and gain full administrative privileges on the affected WordPress site by exploiting this vulnerability. This leads to complete site takeover, including the ability to modify content, install malicious code, and compromise site integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the User Profile Builder plugin or restricting user registration to trusted users only. Monitor the vendor's communications for updates and apply patches promptly once released.