What is the CVSS score of EUVD-2026-43389?

EUVD-2026-43389 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Houzez Login Register are affected by EUVD-2026-43389?

The Houzez Login Register WordPress plugin (versions ≤3.3.3) contains a privilege escalation vulnerability (CVSS 8.2) with no public exploit identified at time of analysis.

How to fix or mitigate EUVD-2026-43389?

Within 24 hours, audit all WordPress installations for Houzez Login Register plugin presence and version; compile inventory of affected sites. Within 7 days, either disable the plugin entirely if not business-critical, or restrict access to registration endpoints via Web Application Firewall, IP whitelisting, or .htaccess restrictions while monitoring for suspicious role elevation. Within 30 days, contact the plugin vendor for patch availability and evaluate migration to alternative login solutions if the plugin remains unpatched.

Houzez Login Register EUVD-2026-43389

| CVE-2026-57768 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-07-13 Patchstack

WordPress Privilege Escalation Wordpress Plugin Houzez Login Register Favethemes

8.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

8.2 HIGH

Registration-flow role elevation is remotely reachable with low complexity and no prior privileges (PR:N); integrity impact is high from gained role, confidentiality only low, availability unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:37 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.2

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3.

AnalysisAI

Privilege escalation in the Houzez Login Register WordPress plugin (versions up to and including 3.3.3) lets remote attackers obtain a higher-privileged role than intended due to incorrect privilege assignment (CWE-266). Reported by Patchstack with a CVSS 8.2 (high) score, the flaw carries a network vector with no privileges or user interaction required and a high integrity impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Houzez Login Register is a companion plugin for the commercial Houzez real-estate WordPress theme, providing custom registration, login, and role-assignment flows (e.g. distinguishing agents, agencies, and standard users). The root cause is CWE-266 Incorrect Privilege Assignment: the plugin assigns a WordPress user role or capability that is broader than the one the account should legitimately receive, so a self-service registration or profile flow ends up granting elevated privileges. Because WordPress roles map directly to administrative capabilities, an incorrect assignment during account creation or role selection can bridge an ordinary visitor to a privileged content-managing or administrative role. The affected package is identified by CPE cpe:2.3:a:favethemes:houzez_login_register:*:*:*:*:*:*:*:* for all versions through 3.3.3.

RemediationAI

Upgrade the Houzez Login Register plugin to the first release above 3.3.3 as published by favethemes; the input confirms 3.3.3 and earlier are affected but does not include an exact fixed version, so released patched version is not independently confirmed - consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/houzez-login-register/vulnerability/wordpress-houzez-login-register-plugin-3-3-3-privilege-escalation-vulnerability) and the favethemes changelog for the exact fixed build before deploying. Until a confirmed fixed version is applied, reduce exposure by disabling or restricting open self-service registration (WordPress 'Anyone can register' / the plugin's registration form), auditing existing user accounts for unexpected elevated roles and removing any anomalous administrator/agent grants, and placing the registration and login endpoints behind a WAF virtual patch (Patchstack offers one) or IP/access restrictions. Note the trade-off: disabling public registration will block legitimate new agent/user sign-ups, so this is a temporary control pending the upgrade.