Filtered by category: WordFence, tag: unauthenticated access × Clear
40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin
Matched: WordPress
A critical authentication bypass vulnerability was found in the User Profile Builder WordPress plugin, affecting over 40,000 sites. Reported July 14, 2026, the flaw allows unauthenticated attackers to log in as the primary administrator (user ID 1), enabling full site takeover. The vulnerability is only exploitable when the plugin's "Automatically Log In" setting is enabled.