CVE-2026-110030: Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration
The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hide Price Until Loginto a version that resolves this vulnerability.Fixed in 1.1.2
Event History
Frequently Asked Questions
Which sites are exposed to unauthorized account creation?
WordPress sites using Hide Price Until Login versions before 1.1.2 are exposed if the plugin's guest-registration handler is reachable. The issue can be exploited even when WordPress user registration is disabled.
Does an attacker need an existing account or other authentication?
No. The vulnerable guest-registration handler allows an unauthenticated attacker to create a WordPress account and receive a logged-in session.
How can I tell whether my site is affected?
Check whether Hide Price Until Login is installed and running a version earlier than 1.1.2. Also review WordPress user accounts and authentication activity for accounts created unexpectedly while site registration was disabled.
What should be done if the plugin cannot be updated immediately?
Restrict or disable access to the plugin's guest-registration functionality until an update is possible. Review and remove unauthorized accounts that may already have been created.