A security vulnerability has been identified in the User Profile Builder plugin for WordPress, impacting all versions up to and including 3.16.4. This flaw allows unauthenticated users (people not logged into your site) to bypass standard login protections and access your site’s main Administrator account, giving them full administrative control over your entire WordPress website.
The issue stems from a coding error in the plugin: when a registration is submitted with a username between 61 and 70 characters long, the plugin mishandles a WordPress core error response. This causes the plugin to generate a valid, one-time login link tied to your site’s top admin account. Any person who obtains this link can log in as the Administrator without needing a password.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-15826
