# CVE-2026-15368: Cozmoslabs User Profile Builder account takeover via auto-login after registration

Source: https://junglewise.ai/threats/cve-2026-15368-cozmoslabs-user-profile-builder-account-takeover-via-auto-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-01  
License: CC BY 4.0 with a link back

CVE-2026-15368 · Severity: info · CVSS 8.1 · Published 2026-08-01

A vulnerability in the User Profile Builder plugin for WordPress allows unauthorized individuals to gain full access to existing user accounts, including administrator accounts. This occurs because the plugin fails to properly verify which account should be logged in automatically after a new user registers. If a site uses specific non-default settings, an attacker could exploit this flaw to take over the website, access sensitive customer data, or disrupt operations.

Technologies: [Cozmoslabs User Profile Builder](https://junglewise.ai/threats/technologies/user-profile-builder). Vendors: [Cozmoslabs](https://junglewise.ai/threats/vendors/cozmoslabs).

## Quick answers

**Is CVE-2026-15368 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15368 being exploited in the wild.

**How severe is CVE-2026-15368?** Informational severity, with a CVSS score of 8.1, published 1 August 2026.

**Which products and versions are affected?** Cozmoslabs User Profile Builder < 3.16.4.

**Is there a fix for CVE-2026-15368?** A patch was published on 2026-07-17: Fixed in version 3.16.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15368 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15368?** Check whether you run Cozmoslabs User Profile Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass and privilege escalation vulnerability exists in the User Profile Builder (Profile Builder) plugin for WordPress due to an insecure implementation of the 'auto-login after registration' feature. The plugin does not sufficiently validate or bind the session generated during the automatic login process to the specific user ID of the newly registered account. On sites utilizing supported but non-default configurations, an unauthenticated attacker can manipulate the registration flow to obtain an authenticated session for an arbitrary existing user, including those with administrative privileges. This is classified as a broken authentication and session management issue (CWE-269). The vulnerability is addressed in version 3.16.4.

## Affected products

- Cozmoslabs User Profile Builder (Profile Builder) < 3.16.4

## Timeline

- 2026-07-17: disclosed
- 2026-07-17: patched: Fixed in version 3.16.4
- 2026-08-01: advisory

## References

- [https://wpscan.com/vulnerability/df1eb738-15bf-4f8b-aa06-e0a42f1e9c2e/](https://wpscan.com/vulnerability/df1eb738-15bf-4f8b-aa06-e0a42f1e9c2e/)

## Related threats

- [User Profile Builder reflected XSS in admin page](https://junglewise.ai/threats/cve-2026-111948-the-user-profile-builder-wordpress-plugin-before-4-0-1-does-not)
- [User Profile Builder privilege escalation via role parameter](https://junglewise.ai/threats/cve-2026-109447-the-user-profile-builder-beautiful-user-registration-forms-user)
- [User Profile Builder display_name stored XSS](https://junglewise.ai/threats/cve-2026-107748-the-user-profile-builder-beautiful-user-registration-forms-user)
- [User Profile Builder stored cross-site scripting in first name field](https://junglewise.ai/threats/cve-2026-100186-the-user-profile-builder-beautiful-user-registration-forms-user)
- [User Profile Builder authentication bypass in file upload](https://junglewise.ai/threats/cve-2026-76548-user-profile-builder-authentication-bypass-in-file-upload)