Is CVE-2026-105703 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105703 being exploited in the wild.

How severe is CVE-2026-105703?

Medium severity, with a CVSS score of 4.7, published 6 October 2026.

Which products and versions are affected?

Phpgurukul User Registration & Login and User Management System 3.3.

How is CVE-2026-105703 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105703?

Check whether you run Phpgurukul User Registration & Login and User Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105703: PHPGurukul User Registration System broken authentication in change password

CVE-2026-105703 · Severity: medium · CVSS 4.7 · Published 2026-10-06

PHPGurukul's User Registration & Login System is a PHP-based admin panel used to manage user accounts. An attacker with access to any admin account can change another admin's password by using a valid password from anywhere in the admin database, bypassing the re-authentication check that should prevent unauthorized password changes. This allows an attacker to take persistent control of a hijacked admin session or account.

Vendors: Phpgurukul.

Quick answers

Is CVE-2026-105703 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105703 being exploited in the wild.
How severe is CVE-2026-105703?: Medium severity, with a CVSS score of 4.7, published 6 October 2026.
Which products and versions are affected?: Phpgurukul User Registration & Login and User Management System 3.3.
Is there a fix for CVE-2026-105703?: No fixed version is recorded yet. Bind the current password validation to the authenticated admin's session ID and account ID, ensuring the SELECT query includes a WHERE clause matching both the id from the session and the provided password hash. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105703 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105703?: Check whether you run Phpgurukul User Registration & Login and User Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Bind the current password validation to the authenticated admin's session ID and account ID, ensuring the SELECT query includes a WHERE clause matching both the id from the session and the provided password hash.

Technical details

The vulnerability is a broken access control flaw (CWE-863) in the change password endpoint (loginsystem/admin/change-password.php). The password validation query checks if the supplied currentpassword matches any admin record without constraining the check to the authenticated user's session ID, allowing an attacker to bypass re-authentication by supplying any valid admin password. An authenticated attacker (with a valid admin session) can exploit this over the network to change any admin account's password by knowing any other admin's password.

Affected products

PHPGurukul User Registration & Login and User Management System 3.3

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.