CVE-2026-15368: Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
User Profile Builder (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.16.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15368?
CVE-2026-15368 has a severity score of 8.1, categorized as high.
How do I fix CVE-2026-15368?
To fix CVE-2026-15368, update the User Profile Builder plugin to version 3.16.4 or later.
What type of vulnerability is CVE-2026-15368?
CVE-2026-15368 is an unauthenticated account takeover vulnerability affecting the User Profile Builder plugin.
Who is affected by CVE-2026-15368?
CVE-2026-15368 potentially affects any user of the User Profile Builder plugin prior to version 3.16.4, including administrators.
When was CVE-2026-15368 published?
CVE-2026-15368 was published on August 1, 2026.