EUVD-2026-60809
GHSA-7r4f-vhrp-c8fv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Requires a subscriber account (PR:L); no confidentiality impact described; integrity and availability impacts are limited and unscoped.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Broken Authentication in User Registration <= 5.2.6 versions.
AnalysisAI
Broken authentication in WPEverest's User Registration WordPress plugin (versions 5.2.6 and below) permits subscriber-level authenticated users to bypass authentication controls and perform unauthorized actions beyond their role permissions. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable with low-privilege access required, producing limited but real integrity and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid subscriber-level (or higher) WordPress account on the target installation; this is confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score reflects a genuine but bounded risk: the PR:L metric confirms exploitation requires at minimum a subscriber-level WordPress account, substantially narrowing the threat surface to sites that allow open or low-barrier user registration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker self-registers a free subscriber account on a WordPress site running User Registration 5.2.6 or earlier, then crafts a request to a plugin endpoint that improperly validates authentication - passing subscriber session tokens to bypass checks intended for higher roles. This allows the attacker to trigger restricted actions such as modifying registration form configurations, elevating their own account role, or disrupting site availability. … |
| Remediation | Update the User Registration plugin beyond version 5.2.6 immediately; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-2-6-broken-authentication-vulnerability and the WordPress plugin repository for the patched release version (exact fix version not independently confirmed in available data). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in User Registration
View allThe User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX ac
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url val
The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could all
A privilege escalation vulnerability exists in the wpeverest User Registration WordPress plugin through version 4.4.9 du
Unauthenticated availability-impacting broken access control affects the ThemeGrill User Registration WordPress plugin v
Reflected cross-site scripting in the wpeverest User Registration plugin for WordPress (all versions up to and including
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln
Broken access control in the WPEverest User Registration WordPress plugin (versions ≤5.2.6) permits unauthenticated remo
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today