CVE-2026-40726: WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability

Synopsis

Broken access control in the User Registration Stripe WordPress plugin (versions 1.3.14 and earlier) allows an unauthenticated remote attacker to reach restricted functionality without logging in. The vulnerability is exploitable over the network with no credentials required and no user interaction needed, as indicated by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Successful exploitation gives the attacker read access to sensitive data and limited write capability against affected resources. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; there is no requirement for local or physical access.

• AuthenticationNot required

  No account or credentials of any privilege level are needed to exploit this vulnerability.

• Victim interactionNot required

  The attacker does not need to trick or involve any user to carry out the attack.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are required.

Blast Radius

• A successful attacker reads sensitive data exposed by the access-controlled endpoints, which may include user registration records, Stripe-related configuration, or payment metadata stored by the plugin.
• The attacker gains limited write access to affected resources, allowing modification of select data or plugin state without full administrative control.
• Confidentiality impact is high, meaning the attacker can extract stored records in full rather than only partial or indirect data.
• Availability of the service is not affected by this vulnerability; the attacker cannot crash or degrade the WordPress instance through this vector alone.