User Profile Builder < 3.16.5 - Unauthenticated Administrator Account Takeover via Auto-Login Type Confusion

Description

The plugin is vulnerable to Authentication Bypass via Type Confusion, due to the `wppb_log_in_user()` function calling `absint()` on the return value of `wp_insert_user()` before performing an `is_wp_error()` check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a `WP_Error` object, but `absint()` coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.