CVE-2026-15368 Overview
CVE-2026-15368 affects the User Profile Builder WordPress plugin in versions before 3.16.4. The plugin does not correctly bind the automatic login performed after user registration to the newly created account. Unauthenticated attackers can obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration. The flaw maps to CWE-269: Improper Privilege Management.
Critical Impact
Unauthenticated attackers can hijack administrator sessions on affected WordPress sites, leading to full site compromise.
Affected Products
- User Profile Builder WordPress plugin versions prior to 3.16.4
- WordPress sites using the plugin in a supported but non-default configuration
- Sites permitting front-end user registration through the plugin
Discovery Timeline
- 2026-08-01 - CVE-2026-15368 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-15368
Vulnerability Analysis
The User Profile Builder plugin provides front-end user registration and profile management for WordPress. After a user completes registration, the plugin can automatically log the new account in. The registration flow fails to correctly associate the resulting authenticated session with the account that was just created. An attacker registering through the front-end form can receive a session cookie tied to an existing account rather than the newly created one.
When the target site is configured to permit auto-login and the plugin lookup resolves to an existing username or email, the login handler binds the session to that pre-existing user. If that user is an administrator, the attacker gains full administrative access without knowing the password. The vulnerability is exploitable over the network without authentication or user interaction, though it requires the site operator to have enabled the specific non-default configuration.
Root Cause
The root cause is improper privilege management [CWE-269] in the post-registration authentication routine. The plugin uses attacker-influenced input to identify the account to authenticate rather than strictly using the identifier of the account created during that request. This trust boundary error lets registration input control which existing account the session represents.
Attack Vector
An unauthenticated attacker submits a crafted registration request to a vulnerable site running a supported non-default configuration. The plugin creates a new account and then invokes its auto-login routine, which resolves to and authenticates as a pre-existing account, such as admin. The attacker receives WordPress authentication cookies for that administrator account and can then access /wp-admin/ with full privileges. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-15368
Indicators of Compromise
- Successful wp-login or session establishment events for administrator accounts immediately following a registration submission from the same client IP.
- Unexpected new user accounts in wp_users created close in time to administrator activity from unfamiliar IP addresses.
- Administrator-level actions such as plugin installs, theme edits, or new admin account creation originating from IPs with no prior admin history.
- Web server access logs showing POST requests to User Profile Builder registration endpoints followed by authenticated requests to /wp-admin/.
Detection Strategies
- Correlate registration form POSTs with subsequent authenticated session cookies mapped to accounts other than the one just created.
- Alert when the same source IP triggers both a user registration event and an administrator-scope action within a short time window.
- Inventory WordPress installations to identify sites running User Profile Builder below version 3.16.4.
Monitoring Recommendations
- Enable WordPress audit logging to capture user creation, login, and role change events with source IP and user agent.
- Forward WordPress and web server logs to a centralized analytics platform for correlation across registration and privileged actions.
- Monitor for outbound changes indicating post-compromise activity, such as new administrator accounts, modified theme files, or scheduled task creation.
How to Mitigate CVE-2026-15368
Immediate Actions Required
- Update the User Profile Builder plugin to version 3.16.4 or later on all WordPress sites.
- Audit wp_users and wp_usermeta for unexpected administrator accounts or recent role changes.
- Force a password reset and invalidate active sessions for all administrator accounts on affected sites.
- Review WordPress and web server logs for registration events followed by administrative activity.
Patch Information
The vendor addressed the flaw in User Profile Builder version 3.16.4. Upgrading to this release or later removes the vulnerable auto-login binding logic. Refer to the WPScan Vulnerability Report for release details.
Workarounds
- Disable the non-default configuration that enables automatic login after registration until the plugin can be updated.
- Temporarily disable front-end user registration through the plugin if updating is not immediately possible.
- Restrict access to the plugin's registration endpoints via web application firewall rules or IP allowlisting.
- Enforce multi-factor authentication for administrator accounts to reduce the impact of session hijacking.
# Update User Profile Builder via WP-CLI
wp plugin update profile-builder --version=3.16.4
wp plugin list --name=profile-builder --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
