What is GHSA-p782-jwj4-rqqc?

GHSA-p782-jwj4-rqqc is a security advisory published by GitHub Security Advisories with High severity. The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic...

Which CVE IDs does GHSA-p782-jwj4-rqqc cover?

GHSA-p782-jwj4-rqqc covers the following CVE IDs: CVE-2026-15368. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p782-jwj4-rqqc?

GHSA-p782-jwj4-rqqc has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-p782-jwj4-rqqcHighCVSS 8.1

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic...

Vendor

GitHub Security Advisories

Published

August 1, 2026

Last Modified

August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-15368 →

📋 Description

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-15368
https://wpscan.com/vulnerability/df1eb738-15bf-4f8b-aa06-e0a42f1e9c2e
https://github.com/advisories/GHSA-p782-jwj4-rqqc