WordPress Plugin Flaw Exposes 40,000 Sites to Admin Takeover

A critical type-confusion vulnerability (CVE-2026-15826, CVSS 9.8) in the User Profile Builder WordPress plugin could let unauthenticated attackers obtain administrator sessions and fully compromise sites; over 40,000 sites were exposed, though exploitation requires the site to use user ID 1 and enable automatic login after registration. Cozmoslabs released version 3.16.5 to address the issue and site owners are advised to update immediately.