CVE-2026-15826: Cozmoslabs User Profile Builder — Admin Takeover Risk for WordPress (June 2026)

CVE-2026-15826 — Cozmoslabs User Profile Builder

CVE-2026-15826 is a critical authentication bypass vulnerability in Cozmoslabs' User Profile Builder plugin for WordPress (versions up to 3.16.4). This flaw allows unauthenticated attackers to gain administrative access to affected sites. No evidence of active exploitation is public yet, but the risk is immediate and severe due to the plugin’s wide deployment and the ease of exploitation.

Attack Vector

The vulnerability stems from a type confusion error in the plugin’s registration and automatic-login workflow. When a site is configured with automatic login enabled and the default admin user (ID 1) exists, an attacker can craft a registration request that triggers the generation of an administrative authentication token. This token grants full admin privileges without prior authentication. No credentials or prior access are required; the attack can be executed remotely against any exposed site meeting the configuration criteria.

Who Is at Risk

All WordPress sites running Cozmoslabs User Profile Builder plugin version 3.16.4 or earlier are vulnerable, especially those with user ID 1 present and automatic login enabled. Over 40,000 sites are estimated at risk globally. Organizations confirmed affected include those using the plugin for user management and registration workflows. Sites with custom admin user IDs or without automatic login enabled are less exposed but should still update immediately.

Patch & Mitigate

• Patch: Upgrade User Profile Builder to the latest version (3.16.5 or newer) immediately. No official patch deadline announced, but delay increases risk of compromise.
• Workaround: Disable automatic login for new registrations and ensure the default admin account (user ID 1) is removed or renamed if possible.
• Detect: Review server and application logs for unexpected admin logins, especially new sessions tied to registration events. Monitor for creation of new admin accounts or installation of unauthorized plugins/themes.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit the authentication bypass to gain entry without credentials.
• TA0003 — Persistence: Attackers can create additional admin accounts or install backdoors for ongoing access.

Source: https://www.infosecurity-magazine.com/news/wordpress-plugin-flaw-40000-sites/