CVE-2026-25425
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Versions up to 5.1.2 have a vulnerability in access control that allows user registration without authentication.
Risk Assessment
Lack of proper access control may lead to unauthorized user registrations, jeopardizing system integrity.
Recommendation
It is recommended to upgrade to the latest version to mitigate this security vulnerability.
Other vulnerabilities in User Registration
See all- CVE-2026-73995Medium
The User Registration plugin version 5.2.6 and earlier has a broken authentication vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to accounts or functions they should not have permissions for.
- CVE-2026-73403Medium
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
Original NVD description (English source)
Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.