What is the CVSS score of EUVD-2026-37620?

EUVD-2026-37620 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of User Registration Stripe are affected by EUVD-2026-37620?

The User Registration Stripe WordPress plugin (v1.3.12 and below) contains a critical access control vulnerability (CVSS 8.2) that enables unauthenticated attackers to bypass authorization and invoke…

How to fix or mitigate EUVD-2026-37620?

24 hours: Inventory all WordPress instances running User Registration Stripe v1.3.12 or earlier; disable the plugin immediately if non-essential; enable debug logging on registration endpoints. 7 days: Contact plugin vendor to confirm patch timeline; evaluate alternative registration plugins or assess cost of internally patched fork. 30 days: If plugin remains deployed, implement Web Application Firewall (WAF) rules restricting registration endpoints to authenticated requests; deploy comprehensive logging and alerting for registration and access control events; execute migration to patched or alternative solution.

User Registration Stripe EUVD-2026-37620

| CVE-2026-49081 HIGH

Missing Authorization (CWE-862)

2026-06-17 Patchstack

Authentication Bypass User Registration Stripe

8.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

8.2 HIGH

Network-reachable WordPress endpoint, no auth or interaction, low-complexity missing-authorization flaw enabling state changes (I:H) with limited data exposure (C:L) and no DoS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:04 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

AnalysisAI

Broken access control in the WordPress plugin User Registration Stripe (versions <= 1.3.12) allows unauthenticated remote attackers to invoke protected functionality without proper authorization checks. The flaw stems from missing capability validation (CWE-862) and carries a CVSS 3.1 score of 8.2 with high integrity impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

User Registration Stripe is a ThemeGrill-developed WordPress plugin (CPE: cpe:2.3:a:themegrill:user_registration_stripe) that extends the User Registration plugin family to accept Stripe-based payments during signup. The vulnerability is classified as CWE-862 (Missing Authorization), meaning at least one plugin endpoint - likely an AJAX action, REST route, or admin-post handler - fails to verify the caller's capability or nonce before executing privileged logic. In WordPress plugins, this pattern typically arises when developers register a callback via add_action('wp_ajax_nopriv_...') or a REST 'permission_callback' that returns true, exposing state-changing operations to anonymous visitors.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data, so administrators should consult https://patchstack.com/database/wordpress/plugin/user-registration-stripe/vulnerability/wordpress-user-registration-stripe-plugin-1-3-12-broken-access-control-vulnerability for the exact fixed release (expected to be the next version after 1.3.12) and upgrade via the WordPress plugin dashboard. As an interim workaround, deactivate the User Registration Stripe plugin on affected sites - this will disable Stripe-based signup payments but eliminates the vulnerable code path entirely - or place the wp-admin/admin-ajax.php and /wp-json/ endpoints related to this plugin behind a WAF rule that blocks unauthenticated requests to its specific action names, accepting that custom rules may break legitimate signup flows. Audit existing users and Stripe subscription records created on or after the plugin was installed to detect possible abuse before patching.