User Registration Stripe EUVD-2026-37595

The target site must have the User Registration Stripe plugin installed and activated at version 1.3.14 or earlier, exposing the plugin's HTTP endpoints (typically /wp-admin/admin-ajax.php with the plugin's action parameter, or its REST route under /wp-json/). No authentication, user interaction, or non-default configuration is required, consistent with PR:N/UI:N. Exploitation is limited to environments where the plugin is reachable from the attacker's network, and the impact ceiling is partial - C:H/I:L/A:N indicates data exposure and limited write capability rather than full site takeover or denial of service.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N rates the issue 8.2 (High): network-reachable, low complexity, no privileges, no user interaction, with high confidentiality and low integrity impact. That signal alone makes it attractive for opportunistic mass-scanning of WordPress sites, particularly because the broken-access-control class is highly automatable on WordPress endpoints. However, no EPSS score, no KEV listing, and no public POC are present in the provided intelligence, so quantified exploitation likelihood is unknown. The Patchstack tag 'Authentication Bypass' is consistent with CWE-862 but is broader than the CVSS impact (which excludes I:H/A:H), suggesting data disclosure or partial tampering rather than full account takeover - security teams should verify the exact endpoint behavior with the Patchstack advisory before deciding the priority is critical versus high.

An attacker scans the internet for WordPress sites running User Registration Stripe <= 1.3.14, then sends an unauthenticated HTTP request directly to the plugin's vulnerable AJAX or REST endpoint to invoke a function that should require a logged-in user with specific capabilities. Because no authorization check is performed, the attacker retrieves sensitive registration/payment-related data (matching C:H) and modifies limited state (matching I:L). No public exploit is identified at time of analysis, but the predictable WordPress endpoint pattern makes weaponization straightforward.