What is the CVSS score of CVE-2026-15368?

CVE-2026-15368 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of User Profile Builder are affected by CVE-2026-15368?

The User Profile Builder WordPress plugin versions before 3.16.4 contain a session hijacking vulnerability allowing unauthenticated attackers to gain unauthorized administrative access to affected…. A patch is available.

Is there a public PoC exploit available for CVE-2026-15368?

Yes, a public proof-of-concept exploit is available for CVE-2026-15368. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-15368?

Within 24 hours, audit your WordPress environment to identify all installations of the User Profile Builder plugin and determine whether the post-registration auto-login feature is enabled, as only non-default configurations are vulnerable. Within 7 days, upgrade all affected instances to User Profile Builder version 3.16.4 or later. Within 30 days, audit administrative access logs from the preceding 90 days to identify any anomalous session activity or unauthorized administrative accounts that may indicate prior exploitation.

User Profile Builder CVE-2026-15368

EUVD-2026-51717 HIGH

Improper Privilege Management (CWE-269)

2026-08-01 WPScan

GHSA-p782-jwj4-rqqc

WordPress Privilege Escalation User Profile Builder Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

AC:H reflects the mandatory non-default configuration prerequisite; PR:N because the attacker initiates exploitation as an anonymous registrant with no prior credentials.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:39 vuln.today

CVSS changed

Aug 05, 2026 - 17:22 NVD

8.1 (None) 8.1 (HIGH)

Patch available

Aug 01, 2026 - 07:01 EUVD

CVE Published

Aug 01, 2026 - 06:00 cve.org

HIGH 8.1

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.

AnalysisAI

Session hijacking in the User Profile Builder WordPress plugin (versions before 3.16.4) allows unauthenticated attackers to obtain an authenticated session for any arbitrary existing user - including site administrators - by exploiting improper account binding in the post-registration auto-login flow. Exploitation is constrained to sites running a supported but non-default plugin configuration, which explains the AC:H in the CVSS vector and the SSVC 'Automatable: no' designation despite total technical impact. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.14% (4th percentile) and SSVC 'Exploitation: none' indicate no confirmed widespread exploitation at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-269 (Improper Privilege Management) within the User Profile Builder plugin's WordPress registration integration. When a new user registers, the plugin triggers an automatic login; the flaw lies in failing to securely bind this session token to the newly created account rather than to an arbitrary existing account chosen or influenced by the attacker. This is a session management integrity failure at the boundary between WordPress's core authentication API and the plugin's registration handler. The affected software is identified via CPE as cpe:2.3:a:unknown:user_profile_builder:*:*:*:*:*:*:*:*, covering all versions prior to 3.16.4. The CPE vendor field is listed as 'unknown' in NVD, indicating incomplete CPE data - the actual vendor is Cozmoslabs. The vulnerability only manifests under a specific non-default plugin configuration, the exact name of which is not disclosed in available intelligence.

RemediationAI

Vendor-released patch: version 3.16.4. Update the User Profile Builder plugin to 3.16.4 or later immediately via the WordPress admin dashboard or by downloading from the WordPress plugin repository. This corrects the session binding logic in the post-registration auto-login flow. If immediate patching is not possible, temporarily disabling user registration under WordPress Settings → General (uncheck 'Anyone can register') removes the exploitable registration trigger entirely - note this blocks all new legitimate user registrations as a trade-off. Alternatively, audit and revert any non-default User Profile Builder configuration related to registration or auto-login behavior until the patch is applied, as default configurations are not reported as vulnerable. Refer to the WPScan advisory at https://wpscan.com/vulnerability/df1eb738-15bf-4f8b-aa06-e0a42f1e9c2e/ for plugin-specific configuration guidance.