CVE-2026-15368
Received Received - Intake

Unauthenticated Session Hijack in User Profile Builder WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: WPScan

Description
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-15368
EUVD
EUVD-2026-51717

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_user_profile_builder user_profile_builder to 3.16.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the User Profile Builder WordPress plugin before version 3.16.4 allows unauthenticated attackers to gain an authenticated session for any existing user, including administrators, by exploiting a flaw in the automatic login process after user registration. This occurs due to improper binding of the session to the newly created account.

Impact Analysis

An attacker could exploit this to log in as any user without credentials, potentially gaining full control of the WordPress site. This includes accessing sensitive data, modifying content, or installing malicious plugins.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Update the User Profile Builder WordPress plugin to version 3.16.4 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15368. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart