diff --git src/wp-includes/user-functions.php src/wp-includes/user-functions.php
index a79d1e8..e03cc17 100644
--- src/wp-includes/user-functions.php
+++ src/wp-includes/user-functions.php
@@ -1275,11 +1275,17 @@ function wp_insert_user( $userdata ) {
 	} elseif ( $userdata instanceof WP_User ) {
 		$userdata = $userdata->to_array();
 	}
+
 	// Are we updating or creating?
 	if ( ! empty( $userdata['ID'] ) ) {
 		$ID = (int) $userdata['ID'];
 		$update = true;
-		$old_user_data = WP_User::get_data_by( 'id', $ID );
+		$old_user_data = get_userdata( $ID );
+
+		if ( ! $old_user_data ) {
+			return new WP_Error( 'invalid_user_id', __( 'Invalid user ID.' ) );
+		}
+
 		// hashed in wp_update_user(), plaintext if called directly
 		$user_pass = $userdata['user_pass'];
 	} else {
diff --git tests/phpunit/tests/user.php tests/phpunit/tests/user.php
index f0b60d1..8faa06f 100644
--- tests/phpunit/tests/user.php
+++ tests/phpunit/tests/user.php
@@ -757,6 +757,21 @@ class Tests_User extends WP_UnitTestCase {
 		$this->assertSame( $expected, $user->user_nicename );
 	}
 
+	/**
+	 * @ticket 28004
+	 */
+	public function test_wp_insert_user_with_invalid_user_id() {
+		$user_login = str_repeat( 'a', 55 );
+		$u = wp_insert_user( array(
+			'ID' => 123,
+			'user_login' => $user_login,
+			'user_email' => $user_login . '@example.com',
+			'user_pass' => 'password',
+		) );
+
+		$this->assertWPError( $u );
+	}
+
 	function test_changing_email_invalidates_password_reset_key() {
 		global $wpdb;
 
@@ -963,7 +978,7 @@ class Tests_User extends WP_UnitTestCase {
 		$user = get_userdata( $testuserid );
 		$pwd_before = $user->user_pass;
 		wp_update_user( $user );
-		
+
 		// Reload the data
 		$pwd_after = get_userdata( $testuserid )->user_pass;
 		$this->assertEquals( $pwd_before, $pwd_after );