{"id":"CVE-2026-15368","state":"PUBLISHED","title":"Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration","description":"The User Profile Builder  WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.","publishedAt":"2026-08-01T06:00:09.399Z","updatedAt":"2026-08-05T16:19:28.543Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown User Profile Builder"],"affected":[{"vendor":"Unknown","product":"User Profile Builder","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.16.4","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/df1eb738-15bf-4f8b-aa06-e0a42f1e9c2e/"],"weaknesses":["CWE-269"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/15xxx/CVE-2026-15368.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-15368","state":"PUBLISHED","datePublished":"2026-08-01T06:00:09.399Z","dateUpdated":"2026-08-05T16:19:28.543Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-07-10T07:53:39.566Z"},"containers":{"cna":{"title":"Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration","descriptions":[{"lang":"en","value":"The User Profile Builder  WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration."}],"affected":[{"vendor":"Unknown","product":"User Profile Builder","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.16.4","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/df1eb738-15bf-4f8b-aa06-e0a42f1e9c2e/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-08-01T06:00:09.399Z"},"credits":[{"lang":"en","value":"Jakub Herman","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-08-05T16:10:41.942747Z","id":"CVE-2026-15368","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","type":"CWE","lang":"en","description":"CWE-269 Improper Privilege Management"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-05T16:19:28.543Z"}}]}}}