EUVD-2026-39782
GHSA-252c-7783-4v3h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable unauthenticated endpoint with no user interaction; limited read/write impact on plugin data only, no availability or scope change.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.
AnalysisAI
Broken access control in the WordPress User Registration plugin (versions <= 5.2.2) allows unauthenticated remote attackers to bypass authorization checks and access or manipulate functionality restricted to privileged users. The flaw stems from missing authorization (CWE-862) on one or more plugin endpoints, permitting network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit opportunistically.
Technical ContextAI
The WordPress User Registration plugin (by WPEverest) provides front-end registration form functionality for WordPress sites. CWE-862 (Missing Authorization) indicates the plugin fails to verify whether the requesting party has permission to perform certain actions before executing them - a missing capability or nonce check on an AJAX handler or REST endpoint is the typical root cause in this class of WordPress plugin flaw. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the vulnerable code path is reachable over the network by any unauthenticated user, consistent with a publicly exposed AJAX action registered without proper authentication gating. Affected versions are confirmed as <= 5.2.2; no CPE string was supplied in the intelligence feed.
RemediationAI
Update the User Registration plugin to a version beyond 5.2.2 as soon as the vendor releases a patched build; check the WordPress plugin repository (wordpress.org/plugins/user-registration) or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-1-5-broken-access-control-vulnerability for the confirmed fixed version number, which is not independently confirmed in the available intelligence data. If an immediate update is not possible, consider deactivating the plugin on internet-exposed sites until patching is complete - deactivation eliminates the attack surface entirely at the cost of losing registration functionality. Restricting access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) by IP for unauthenticated requests via WAF or web server rules can reduce exposure but may break legitimate front-end functionality and is not a substitute for patching.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today