Is CVE-2026-49081 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49081 being exploited in the wild.

How severe is CVE-2026-49081?

High severity, with a CVSS score of 8.2, published 17 June 2026.

Which products and versions are affected?

ThemeGrill User Registration Stripe <= 1.3.12.

Is there a fix for CVE-2026-49081?

A patch was published on 2026-06-17: Patch confirmed available in version 1.3.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49081 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49081?

Check whether you run ThemeGrill User Registration Stripe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49081: ThemeGrill User Registration Stripe broken access control

Q: Is there a fix for CVE-2026-49081?

A patch was published on 2026-06-17: Patch confirmed available in version 1.3.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49081 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49081?

Check whether you run ThemeGrill User Registration Stripe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49081 · Severity: high · CVSS 8.2 · Published 2026-06-17

The User Registration Stripe plugin for WordPress, which handles payment integrations for user sign-ups, contains a security flaw that allows unauthorized individuals to bypass access controls. An attacker could exploit this to perform actions they are not permitted to do, potentially interfering with registration processes or payment records. This could lead to unauthorized account creations or financial data manipulation without needing to log in.

Vendors: ThemeGrill.

Quick answers

Is CVE-2026-49081 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49081 being exploited in the wild.
How severe is CVE-2026-49081?: High severity, with a CVSS score of 8.2, published 17 June 2026.
Which products and versions are affected?: ThemeGrill User Registration Stripe <= 1.3.12.
Is there a fix for CVE-2026-49081?: A patch was published on 2026-06-17: Patch confirmed available in version 1.3.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49081 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49081?: Check whether you run ThemeGrill User Registration Stripe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The User Registration Stripe plugin for WordPress (versions <= 1.3.12) suffers from a broken access control vulnerability categorized as missing authorization (CWE-862). The flaw exists because the plugin fails to properly validate permissions or implement nonce checks on certain functions, allowing unauthenticated remote attackers to execute privileged actions. An attacker can exploit this over the network without any user interaction to potentially modify registration data or bypass payment requirements. The issue is resolved in version 1.3.13.

Affected products

ThemeGrill User Registration Stripe <= 1.3.12

Timeline

2025-10-09: other: Vulnerability reported by researcher 0xd4rk5id3
2026-06-05: disclosed: Initial disclosure by Patchstack
2026-06-17: advisory: NVD publication date
2026-06-17: patched: Patch confirmed available in version 1.3.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.