Executive brief
The User Registration Stripe plugin for WordPress, which handles payment integrations for user sign-ups, contains a security flaw that allows unauthorized individuals to bypass access controls. An attacker could exploit this to perform actions they are not permitted to do, potentially interfering with registration processes or payment records. This could lead to unauthorized account creations or financial data manipulation without needing to log in.
Technical details
The User Registration Stripe plugin for WordPress (versions <= 1.3.12) suffers from a broken access control vulnerability categorized as missing authorization (CWE-862). The flaw exists because the plugin fails to properly validate permissions or implement nonce checks on certain functions, allowing unauthenticated remote attackers to execute privileged actions. An attacker can exploit this over the network without any user interaction to potentially modify registration data or bypass payment requirements. The issue is resolved in version 1.3.13.
Affected products
- ThemeGrill User Registration Stripe <= 1.3.12
Timeline
- 2025-10-09: other: Vulnerability reported by researcher 0xd4rk5id3
- 2026-06-05: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: NVD publication date
- 2026-06-17: patched: Patch confirmed available in version 1.3.13