CVE-2026-49081: WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability

Synopsis

A broken access control vulnerability affects the User Registration Stripe plugin for WordPress, versions 1.3.12 and earlier. The flaw is reachable over the network without any authentication, meaning any external attacker can send crafted requests to the affected endpoint. Successful exploitation gives an attacker the ability to read limited data and perform high-impact unauthorized writes or modifications to protected functionality. No fix version has been published; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via standard HTTP/HTTPS.

• AuthenticationNot required

  No account or session credential of any kind is needed; the attacker sends unauthenticated requests directly to the affected endpoint.

• Victim interactionNot required

  The attack is entirely server-side and requires no action from any user or administrator of the WordPress site.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• An unauthenticated attacker can read a limited subset of application data exposed through the broken access control endpoint.
• An attacker can make high-impact unauthorized modifications to protected data or plugin-controlled records, such as altering registration configurations, subscription states, or Stripe-linked user data.
• Because integrity impact is rated high, an attacker may be able to manipulate payment or registration workflows in ways that affect business logic downstream.