CVE-2026-74017
MediumCVSS 5.3Summary
Unauthenticated Broken Access Control vulnerability in User Registration plugin up to version 5.2.7. Unauthenticated users can access restricted functionality, such as admin panel or sensitive resources.
Risk Assessment
An attacker without an account may perform administrative operations, which could lead to full site compromise or data leakage.
Recommendation
Update the User Registration plugin to version 5.2.8 or later. Also, restrict access to admin panels with additional security measures.
Other vulnerabilities in User Registration
See all- CVE-2026-73995Medium
The User Registration plugin version 5.2.6 and earlier has a broken authentication vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to accounts or functions they should not have permissions for.
- CVE-2026-73403Medium
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
- CVE-2026-25425High
Versions up to 5.1.2 have a vulnerability in access control that allows user registration without authentication.
Original NVD description (English source)
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS