User Registration CVE-2026-73995

Exploitation requires a valid subscriber-level (or higher) WordPress account on the target installation; this is confirmed by the CVSS PR:L metric. Sites with open user registration - where any visitor can self-create a subscriber account - effectively have no meaningful barrier to exploitation, since an attacker can self-provision the required credential. Sites that restrict account creation to administrator invitation only are significantly less exposed. The vulnerability is exploitable over the network without user interaction (AV:N, UI:N). No specific non-default configuration or feature flag is described as a prerequisite in available data. Limiting factors: requires at minimum one valid WordPress account; impact is bounded to integrity and availability (C:N), so data exfiltration is not confirmed.

The CVSS 5.4 Medium score reflects a genuine but bounded risk: the PR:L metric confirms exploitation requires at minimum a subscriber-level WordPress account, substantially narrowing the threat surface to sites that allow open or low-barrier user registration. Attack complexity is low (AC:L) and no user interaction is required once authenticated, making exploitation straightforward for any subscriber who discovers the flaw. The S:U scope change indicates impact is confined to the vulnerable component, with no lateral movement to other WordPress subsystems confirmed. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified. No KEV listing and no confirmed POC means this is currently a theoretical-but-credible risk rather than an actively weaponized threat. The I:L and A:L impact ratings suggest partial unauthorized modification or disruption rather than full site compromise. Defenders should prioritize based on whether their sites permit open subscriber self-registration - if so, any unauthenticated visitor can trivially acquire the required privilege level.

An attacker self-registers a free subscriber account on a WordPress site running User Registration 5.2.6 or earlier, then crafts a request to a plugin endpoint that improperly validates authentication - passing subscriber session tokens to bypass checks intended for higher roles. This allows the attacker to trigger restricted actions such as modifying registration form configurations, elevating their own account role, or disrupting site availability. No public POC has been identified, but the low attack complexity (AC:L) means exploitation is straightforward for a skilled attacker who reverse-engineers the flaw from the plugin source.