CVE-2026-73995: User Registration Auth Bypass Vulnerability

CVE-2026-73995 Overview

CVE-2026-73995 is a broken authentication vulnerability affecting the WordPress User Registration plugin in versions up to and including 5.2.6. The flaw is categorized under [CWE-290] Authentication Bypass by Spoofing. An authenticated attacker with subscriber-level privileges can abuse the authentication logic to bypass intended access controls. The issue was published to the National Vulnerability Database (NVD) on 2026-08-18 and last updated on 2026-08-20. Exploitation requires low privileges and no user interaction, and can be performed over the network.

Critical Impact
A subscriber-level account can bypass authentication controls in the User Registration plugin, leading to limited integrity and availability impact on affected WordPress sites.

Affected Products

WordPress User Registration plugin versions <= 5.2.6
WordPress sites with the User Registration plugin installed and active
Any subscriber-accessible WordPress environment running the vulnerable plugin

Discovery Timeline

2026-08-18 - CVE-2026-73995 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73995

Vulnerability Analysis

The vulnerability resides in the authentication logic of the WordPress User Registration plugin. An attacker holding a low-privileged subscriber account can leverage the flaw to spoof authentication state and act outside the boundaries set by the plugin's access controls. The weakness is classified as [CWE-290] Authentication Bypass by Spoofing, meaning the plugin trusts a value or state that can be influenced or replayed by an authenticated user. Successful exploitation grants limited integrity and availability impact, without disclosing confidential data. The EPSS probability for this issue is 0.345% at percentile 27.77, indicating a currently low likelihood of near-term exploitation activity.

Root Cause

The root cause is improper verification of authentication identity within the plugin's request handling. The plugin fails to correctly validate that the acting user is authorized for a given action, allowing a subscriber to spoof authenticated context. The Patchstack Vulnerability Report documents the affected code path and version boundary at 5.2.6.

Attack Vector

The attack vector is network-based. The attacker must first authenticate as a subscriber, which is typically low-friction on WordPress sites that allow open registration. Once authenticated, the attacker sends crafted HTTP requests to plugin endpoints that mishandle authentication verification. No user interaction from an administrator or other privileged user is required.

No verified public proof-of-concept code is available. See the Patchstack Vulnerability Report for further technical details.

Detection Methods for CVE-2026-73995

Indicators of Compromise

Unexpected privilege changes or role modifications on subscriber accounts within WordPress
Anomalous POST requests to User Registration plugin endpoints from subscriber-level sessions
New administrative or elevated actions performed by accounts recently created via the plugin

Detection Strategies

Audit WordPress access logs for repeated authenticated requests to user-registration plugin routes from low-privileged sessions
Compare active User Registration plugin version against 5.2.6 and flag installations at or below this version
Correlate subscriber logins with subsequent actions that should require elevated capabilities

Monitoring Recommendations

Enable WordPress audit logging for authentication events, capability checks, and role assignments
Monitor plugin file integrity and configuration changes on the WordPress installation
Alert on newly registered subscriber accounts that immediately access non-standard plugin endpoints

How to Mitigate CVE-2026-73995

Immediate Actions Required

Update the WordPress User Registration plugin to a version later than 5.2.6 once the vendor fix is applied
Review all existing subscriber accounts and remove those that appear anomalous or unused
Restrict open user registration on sites that do not require it

Patch Information

Refer to the Patchstack Vulnerability Report for patched version guidance. Administrators should upgrade to the fixed release provided by the plugin vendor and verify the plugin version after upgrade.

Workarounds

Disable the User Registration plugin until a patched version is installed
Temporarily disable public user registration in WordPress general settings
Apply a web application firewall (WAF) rule to block anomalous requests to User Registration plugin endpoints from non-administrative sessions

bash

# Configuration example: disable public registration via wp-cli
wp option update users_can_register 0
wp plugin deactivate user-registration
wp plugin status user-registration