Executive brief
A vulnerability in the User Profile Builder plugin for WordPress allows unauthorized individuals to gain full access to existing user accounts, including administrator accounts. This occurs because the plugin fails to properly verify which account should be logged in automatically after a new user registers. If a site uses specific non-default settings, an attacker could exploit this flaw to take over the website, access sensitive customer data, or disrupt operations.
Technical details
An authentication bypass and privilege escalation vulnerability exists in the User Profile Builder (Profile Builder) plugin for WordPress due to an insecure implementation of the 'auto-login after registration' feature. The plugin does not sufficiently validate or bind the session generated during the automatic login process to the specific user ID of the newly registered account. On sites utilizing supported but non-default configurations, an unauthenticated attacker can manipulate the registration flow to obtain an authenticated session for an arbitrary existing user, including those with administrative privileges. This is classified as a broken authentication and session management issue (CWE-269). The vulnerability is addressed in version 3.16.4.
Affected products
- Cozmoslabs User Profile Builder (Profile Builder) < 3.16.4
Timeline
- 2026-07-17: disclosed
- 2026-07-17: patched: Fixed in version 3.16.4
- 2026-08-01: advisory