CVE-2026-15368 is a privilege management vulnerability (CWE-269) in the User Profile Builder WordPress plugin prior to version 3.16.4. The flaw arises from improper binding of the automatic login session performed after user registration, which can be exploited by unauthenticated attackers to hijack authenticated sessions of arbitrary existing users, including administrators, when the site uses a supported but non-default configuration. This vulnerability has a CVSS v3.1 base score of 8.1, indicating high severity, with network attack vector, high complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

An unauthenticated attacker can gain an authenticated session as any existing user, including administrators, potentially leading to full site compromise. This affects confidentiality, integrity, and availability of the affected WordPress site. The vulnerability requires a specific non-default configuration to be exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is available, administrators should review their User Profile Builder plugin configuration and avoid using the vulnerable non-default settings that enable this issue. Monitor vendor channels for updates and apply patches promptly once released.