CVE Explorer
CVE-2026-15368
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"User Profile Builder","vendor":"Unknown","versions":[{"lessThan":"3.16.4","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:a6bebd6d803a0e0a3ae0323e71358146e19142e1d743628f3397e954f49164c9 · sha256:74b299a7769780d6… · /containers/cna/affected/0
CWE assertions
1 source assertion{"description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:a6bebd6d803a0e0a3ae0323e71358146e19142e1d743628f3397e954f49164c9 · sha256:74b299a7769780d6… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/df1eb738-15bf-4f8b-aa06-e0a42f1e9c2e/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:a6bebd6d803a0e0a3ae0323e71358146e19142e1d743628f3397e954f49164c9 · sha256:74b299a7769780d6… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.