What is the CVSS score of CVE-2026-40726?

CVE-2026-40726 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of User Registration Stripe are affected by CVE-2026-40726?

The User Registration Stripe WordPress plugin (versions ≤1.3.14) contains a broken access control vulnerability (CVSS 8.2; no public exploit identified at time of analysis) allowing remote attackers…

How to fix or mitigate CVE-2026-40726?

Within 24 hours: Audit all WordPress installations for User Registration Stripe plugin version 1.3.14 and earlier; immediately deactivate the affected plugin. Within 7 days: Review access logs for unauthorized registration attempts; identify and inventory any exposed user registration or payment data. Within 30 days: Migrate to an actively maintained alternative (WooCommerce Subscriptions with Stripe, Gravity Forms, or custom implementation) and remove the vulnerable plugin entirely.

User Registration Stripe CVE-2026-40726

EUVD-2026-37595 HIGH

Missing Authorization (CWE-862)

2026-06-17 Patchstack

WordPress Authentication Bypass Wordpress Plugin User Registration Stripe Themegrill

8.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Remote unauthenticated HTTP endpoint with no UI; missing authorization yields high confidentiality disclosure and limited integrity write, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:18 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

AnalysisAI

Broken access control in the User Registration Stripe WordPress plugin (versions 1.3.14 and earlier) allows remote unauthenticated attackers to access functionality that should require authorization, leading to high confidentiality exposure and limited integrity tampering. The flaw is reported by Patchstack and tagged as an authentication bypass, but no public exploit code has been identified at time of analysis. EPSS data was not provided, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the User Registration Stripe plugin by ThemeGrill (CPE cpe:2.3:a:themegrill:user_registration_stripe), an add-on to the popular User Registration plugin that integrates Stripe payments into WordPress registration forms. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints - typically exposed through WordPress AJAX (admin-ajax.php) or REST routes - fail to perform a capability or nonce check before executing privileged operations, so any unauthenticated visitor can invoke them. This pattern is endemic to WordPress plugins that register actions via add_action('wp_ajax_nopriv_...') or REST routes without a permission_callback.

RemediationAI

Upgrade the User Registration Stripe plugin to a version newer than 1.3.14 once ThemeGrill publishes a fixed release; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/user-registration-stripe/vulnerability/wordpress-user-registration-stripe-plugin-1-3-14-broken-access-control-vulnerability for the exact patched version, as the input data does not specify it (treat this as 'Patch available per vendor advisory' until the fixed version is confirmed). If a patched build is not yet available or cannot be deployed, deactivate the User Registration Stripe plugin (which will disable Stripe-based registration flows), or place the WordPress site behind a WAF/Patchstack vPatch and block unauthenticated requests to the plugin's admin-ajax actions and REST routes; restricting /wp-admin/admin-ajax.php and /wp-json/ paths used by the plugin to authenticated sessions will also blunt the attack but may break legitimate front-end registration if any nopriv actions are required.