The User Profile Builder WordPress plugin before version 3.16.4 incorrectly associates the automatic login performed after a new user registers with an existing account, enabling an attacker without credentials to receive an authenticated session for any user, including administrators. This flaw bypasses authentication controls and allows the attacker to impersonate privileged users and perform actions with full rights.

Any WordPress site using the User Profile Builder plugin older than 3.16.4 and configured with the supported, non‑default registration settings is vulnerable. The issue applies to all user accounts listed on the site, not just those created through the plugin.

Although the EPSS score is below 1% and the vulnerability is not currently listed in the CISA KEV catalog, the impact of an account takeover is severe. The attack vector is a simple web request to the registration endpoint; an unauthenticated attacker can craft a registration request that triggers auto‑login tied to an arbitrary existing user. No additional privileges or local code execution are required, making the exploit straightforward for someone with web access to the target site. The low EPSS suggests limited active exploitation, but the high potential damage warrants prompt action. The CVSS base score is 8.1, indicating high severity.