User Registration CVE-2026-103076

Exploitation requires an active, authenticated WordPress session (typically an administrator or privileged user of the User Registration plugin) AND successful social engineering to make that victim load attacker-controlled content while logged in (UI:R). It is further limited to User Registration versions from n/a through 5.2.8. The attack fails if the targeted user is not logged in, if anti-CSRF nonce protections are effective, or if standard WordPress SameSite cookie behavior blocks the cross-site request. No special non-default plugin configuration is indicated in the description.

This is a moderate-severity CSRF flaw (CVSS 5.4) that is a low priority for most defenders. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) describes a network-reachable attack requiring no attacker privileges but mandatory victim interaction (UI:R), with only low integrity and availability impact and no confidentiality impact - consistent with a classic CWE-352 CSRF. No EPSS score, KEV listing, or POC is present in the provided data: exploitation status is 'no public exploit identified at time of analysis', and there is no evidence of active exploitation. The PR:N rating reflects CVSS CSRF convention (the attacker authenticates nothing themselves) but real exploitation depends on luring an already-authenticated WordPress user/administrator to a malicious page, which materially limits practical impact. Note a tension between PR:N and the practical requirement that the victim hold a privileged session - this is inherent to CSRF scoring and not a data error. Overall: a legitimate issue to patch during routine maintenance, not an emergency.

An attacker crafts a malicious web page containing a forged request targeting a state-changing action in the User Registration plugin, then lures a logged-in WordPress administrator to visit it (e.g., via phishing). When the admin's browser loads the page, it silently submits the forged request using the admin's authenticated session, altering plugin or registration settings. No public exploit code is identified in the provided data.