CVE-2026-73995: WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability

Q: Which deployments are identified as affected?

Sites using User Registration version 5.2.6 or earlier are identified as affected. The issue is described as a subscriber broken-authentication vulnerability.

Q: What level of access and attacker interaction does exploitation require?

The CVSS vector indicates network-reachable exploitation with low attack complexity, no user interaction, and low privileges required. It also indicates low integrity and availability impact, with no confidentiality impact.

Published Aug 18, 2026

Updated

Subscriber Broken Authentication in User Registration <= 5.2.6 versions.

Affected Software

1 affected component

wordpress/User Registration<=5.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress User Registration Plugin to a version that resolves this vulnerability.
Fixed in 5.2.7

Event History

Aug 18, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are identified as affected?

Sites using User Registration version 5.2.6 or earlier are identified as affected. The issue is described as a subscriber broken-authentication vulnerability.

What level of access and attacker interaction does exploitation require?