CVE-2026-15826

The User Profile Builder plugin for WordPress has a security flaw that allows unauthorized users to bypass authentication and access the site's administrator account. This occurs when a user attempts to register with a username between 61 and 70 characters, which WordPress rejects due to a username length restriction. However, the plugin's handling of this rejection allows it to inadvertently create a login token for the administrator account, enabling an attacker to gain full control over the site.

Based on public CVE data (MITRE/NVD).