User Profile Builder CVE-2026-15368

Exploitation requires three concurrent conditions: (1) User Profile Builder plugin installed at a version prior to 3.16.4; (2) WordPress user registration must be enabled, since the vulnerability is triggered during the post-registration auto-login flow; (3) the site must be operating a 'supported but non-default configuration' of the User Profile Builder plugin - the exact configuration setting is referenced in the CVE description but not named in any available intelligence source, meaning defenders cannot yet pinpoint the precise toggle. Default plugin configurations are explicitly stated as not vulnerable. The CVSS AC:H and SSVC 'Automatable: no' ratings jointly confirm that the configuration prerequisite materially limits exploitability: attackers cannot reliably exploit arbitrary installations at scale. Authentication is not required by the attacker (CVSS PR:N) - they begin as an anonymous registrant.

The CVSS 8.1 (High) vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H accurately reflects the risk profile: fully remote, no authentication or user interaction required, but dependent on a non-default configuration (AC:H). This configuration gate is the primary risk-reduction factor and is corroborated by multiple independent signals: SSVC rates 'Automatable: no' (mass scanning cannot reliably identify and exploit vulnerable targets) and EPSS at 0.14% (4th percentile) indicates very low observed exploitation probability despite the POC being public. SSVC 'Technical Impact: total' confirms that when exploitation succeeds, the outcome is full site compromise - administrator session seizure. The disconnect between the available POC and the low EPSS score is consistent with the target pool being narrow due to the non-default configuration requirement. This is a genuine high priority for any site running the plugin in the vulnerable configuration, but not a broad mass-exploitation threat. No CISA KEV listing at time of analysis.

An unauthenticated attacker identifies a WordPress site running User Profile Builder in the vulnerable non-default configuration with user registration enabled. The attacker initiates the registration flow for a new account and, leveraging the publicly available WPScan proof-of-concept, manipulates the session binding during the post-registration auto-login step to receive a valid authenticated session token associated with a targeted existing administrator account rather than the newly created one. The attacker then uses that session to install a malicious plugin, exfiltrate user data, or fully backdoor the site.