Privilege escalation in User Profile Builder
CVE-2026-15368
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.
Vulnerability class: Privilege Escalation
EPSS: 0.002 (13.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Unknown User Profile Builder — versions 0
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-15368?
- CVE-2026-15368 is a high-severity vulnerability in User Profile Builder, classified under Improper Privilege Management. CVSS score: 8.1/10. Published 2026-08-01.
- How severe is CVE-2026-15368?
- High severity. CVSS v3 base score is 8.1 out of 10.