Under normal conditions, submitting a registration request with a username between 61 and 70 characters triggers a validation failure in WordPress core, returning a WP_Error object. Due to the type confusion, the absint() function coerces this WP_Error object into the integer 1. Because the error check occurs after this coercion, the plugin incorrectly proceeds as if the operation succeeded for the user with ID 1 (the site Administrator). This allows an unauthenticated attacker to generate a valid autologin nonce and gain full administrative access to the WordPress instance.

Attack Chain

1. Attacker identifies a WordPress site utilizing the User Profile Builder plugin version 3.16.4 or lower.
2. Attacker initiates the registration process provided by the plugin endpoint.
3. Attacker crafts a registration payload containing a username length between 61 and 70 characters.
4. The plugin calls wp_insert_user(), which triggers an error response from WordPress core.
5. The vulnerable wppb_log_in_user() function processes the error object via absint(), casting it to the integer 1.
6. The plugin logic bypasses the is_wp_error() check due to the type conversion.
7. The plugin generates and returns a session nonce associated with user ID 1.
8. Attacker uses the returned nonce to authenticate as the site Administrator and gains full control.

Impact

Successful exploitation results in full administrative takeover of the affected WordPress site. This grants attackers the ability to modify site content, inject malicious scripts, install backdoors, and exfiltrate sensitive data. Given the ubiquity of WordPress and the plugin's purpose, the potential victim count is significant across small-to-medium enterprise and personal website hosting sectors.

Recommendation

• Immediately update the User Profile Builder plugin to the latest patched version available from the vendor.
• If an update cannot be applied immediately, disable new user registration functionality within the plugin settings to mitigate the exploit vector.
• Audit WordPress user activity logs for suspicious logins occurring shortly after registration attempts or from unrecognized IP addresses.
• Deploy web application firewall (WAF) rules to inspect registration requests for unusually long usernames (61-70 characters) targeting the specific registration endpoint used by the plugin.