CVE-2026-75965

The User Profile Builder plugin for WordPress up to version 3.16.4 is vulnerable to authentication bypass via type confusion. The wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress rejects it with a WP_Error object, but absint() coerces that object to the integer 1, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This allows unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover.

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress (up to and including 4.0.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.

The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Avatar Field in all versions up to and including 4.0.2 due to insufficient input sanitization and output escaping. It is exploitable via a nonce-free GET request to /wp-admin/profile.php without requiring a profile-form submission.

The User Profile Builder plugin for WordPress up to version 3.15.7 is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to and including 4.0.0. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator visits the Unconfirmed Email Addresses list and interacts with row-action links.

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the plugin itself, so further impact requires a suitable gadget from another installed plugin.

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.

The User Profile Builder WordPress plugin before version 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.

The User Profile Builder plugin for WordPress up to version 3.15.5 is vulnerable to Insecure Direct Object Reference in the wppb_save_avatar_value() function due to missing validation on a user controlled key. Authenticated attackers with subscriber-level access and above can reassign ownership of arbitrary posts and attachments by changing 'post_author'.