What is the CVSS score of CVE-2026-74001?

CVE-2026-74001 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-74001?

Within 24 hours, identify all WordPress instances running WPEverest User Registration & Membership Pro versions 5.4.5 and earlier; disable the plugin or restrict public access to registration endpoints; audit all user accounts for unauthorized modifications and privilege escalation to admin status. Within 7 days, implement Web Application Firewall (WAF) rules to block account takeover attack patterns, enable security logging for registration and authentication events, and monitor daily for exploitation attempts. Within 30 days, check WPEverest's security advisories for a patch release; if available, test in non-production environment before production deployment; if unavailable, evaluate alternative WordPress membership solutions and establish a migration timeline.

User Registration Pro CVE-2026-74001

EUVD-2026-63314 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-20 Patchstack

GHSA-89qm-92rc-c56h

WordPress Information Disclosure Wordpress Plugin User Registration Membership Pro Wpeverest

9.8

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach WordPress registration endpoint
Delivery

Send crafted request bypassing auth check
Exploit

Bind session to target account
Execution

Log in as victim/admin
Impact

Full account/site takeover

Vulnerability Assessment

Weakness	CWE CWE-288 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Alternate path authentication
Exploitation Conditions	Requires the User Registration & Membership Pro plugin (version 5.4.5 or earlier) to be installed and active on a reachable WordPress site with its registration/login/membership functionality exposed to attackers. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication or user-interaction prerequisites - exploitation is remote and unauthenticated against affected installations. Limiting factors: the site must actually deploy this specific commercial Pro add-on (not merely the free User Registration plugin) at a vulnerable version, and the impact ceiling depends on whether the reachable account-takeover path reaches privileged (admin) accounts, which the provided data does not fully specify.
Impact	The signals are strongly aligned toward high priority for exposed WordPress sites running this plugin: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates fully remote, low-complexity, unauthenticated exploitation, and the H/H/H impact reflects that taking over a privileged account yields full site compromise. Mitigating the urgency, no EPSS score was provided, there is no KEV listing (not confirmed actively exploited), and no POC has been identified - so weaponization is not yet demonstrated. The main uncertainty is exact scope: the advisory describes 'account takeover' but the precise vulnerable endpoint and whether administrator accounts (versus only member accounts) can be seized are not spelled out in the provided data; if only low-privilege member accounts are reachable, real-world integrity/availability impact would be lower than the 9.8 implies. Verify specifics against the Patchstack advisory.
Exploit ScenarioDerived	An attacker who can reach the WordPress site sends a crafted request to the plugin's vulnerable registration or authentication endpoint, exploiting the broken authentication check to bind their session to a targeted account rather than a legitimately verified one. With no credentials, privileges, or user interaction required, they log in as that user - and if an administrator account is reachable, they obtain full control of the site. No public exploit code has been identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 20, 2026

Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

RemediationAI

No exact fixed version is stated in the provided data; since 5.4.5 and earlier are affected, upgrade to the next vendor-released version above 5.4.5 as published by WPEverest/Patchstack - patched version not independently confirmed here, so confirm the target release in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/user-registration-pro/vulnerability/wordpress-user-registration-membership-pro-plugin-5-4-5-account-takeover-vulnerability) before applying. Until patched, compensating controls include disabling the plugin's public self-registration and login endpoints if the site does not require open membership (side effect: legitimate users cannot self-register or log in), placing the registration/login pages behind a WAF rule or Patchstack virtual patch, and restricting access to the affected endpoints via IP allowlisting where feasible. Because the flaw enables account takeover, also audit existing accounts and force a password/session reset for administrators and members after patching.

Affected VersionsENISA

User Registration & Membership Pro n/a ≤5.4.5

Affected Packages

euvd user_registration_membership_pro no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is WPEverest's User Registration & Membership Pro, a commercial add-on to the widely used User Registration WordPress plugin that adds paid membership, login, and profile-management flows. The CPE cpe:2.3:a:wpeverest:user_registration_&_membership_pro identifies the WordPress plugin as the sole affected product. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel / Improper Authentication): the plugin exposes a registration or authentication code path that fails to properly verify identity, allowing an attacker to authenticate as, or bind their session to, another user's account without valid credentials. Patchstack classifies the outcome as account takeover with an information-disclosure dimension.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Unauthenticated remote broken-auth account takeover (AV:N/AC:L/PR:N/UI:N); seizing a privileged account yields full C/I/A, hence H/H/H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.

Executive ViewAI

Why It Matters

WPEverest User Registration & Membership Pro WordPress plugin (versions ≤5.4.5) contains a CVSS 9.8 authentication bypass enabling unauthenticated account takeover including administrator access. No public exploit identified at time of analysis. This affects all WordPress installations running the vulnerable plugin version, potentially exposing user data and granting attackers administrative site control. No vendor-released patch identified at time of analysis.

Business Impact: Severe

Compensating Controls

Interim mitigations pending vendor patch availability: (1) disable the plugin entirely if operationally feasible; (2) implement IP-based access controls restricting registration endpoints to authorized networks only; (3) enforce multi-factor authentication (MFA) sitewide to increase exploitation barrier; (4) deploy WAF rules to detect and block account takeover attack patterns; (5) enable continuous audit logging for authentication, user creation, and administrative privilege changes with real-time alerting; (6) subscribe to WPEverest security advisories for patch notifications.

Threat Intelligence Overview

EPSS Score

0.4%

Top 66% exploitable

Prevalence

Medium

commercial membership add-on for a popular WP plugin, moderate paid install base

Social Media

Sightings

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.