User Registration EUVD-2026-57916

The WPEverest User Registration plugin version 5.2.6 or earlier must be installed and active on the WordPress site. No authentication is required (PR:N per CVSS vector), and no user interaction is needed (UI:N), meaning any network-accessible attacker can attempt exploitation directly. Attack complexity is low (AC:L), implying no race condition or special timing is required. Exploitation is limited by the following factors: the plugin must be active (deactivated installations are not vulnerable); impact is constrained to integrity modifications only with no confidentiality or availability consequence; and sites that have disabled open user registration in WordPress settings may reduce but not necessarily eliminate exposure depending on which specific endpoints are affected. No special platform, operating system, or non-default WordPress configuration has been identified as a prerequisite beyond the plugin's presence and activation.

The CVSS 5.3 Medium score reflects a meaningful but bounded threat: the attack is fully network-accessible with no prerequisites (AV:N/AC:L/PR:N/UI:N), yet impact is limited to integrity (I:L) with no confidentiality or availability consequence. No EPSS data was supplied, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified, indicating this is not currently subject to widespread automated exploitation. Real-world risk is moderate for WordPress environments with open user registration enabled - the absence of authentication requirements lowers the bar for opportunistic abuse, but the constrained impact scope (no data exfiltration, no service disruption) limits blast radius. Sites that have already disabled public user registration or deployed a WAF with WordPress-aware rulesets face materially reduced exposure. SSVC signals: exploitation status is none confirmed; the attack is automatable given AC:L/PR:N; technical impact is partial. Overall, this warrants timely patching but is not an emergency for most deployments.

An unauthenticated attacker sends a crafted HTTP POST or GET request directly to a vulnerable registration endpoint exposed by the plugin - such as an unprotected AJAX action or REST route - bypassing the missing authorization gate (CWE-862). The server processes the request as if it were legitimately authorized, allowing the attacker to manipulate registration-related data or trigger restricted registration actions. No public exploit code exists at time of analysis, but the low attack complexity (AC:L) means a motivated attacker could develop a working proof of concept with minimal effort.