5.3
MediumCVSS 3.1 · from CISA
CVE-2026-110030
Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration
Hide Price Until Login · Missing authorization · CWE-862AffectedHide Price Until Login
FixUpdate to 1.1.2 or newer
PublishedOct 29, 06:00 · WPScan
Scored5.3 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.
From WPScan
Affected and fixed versions
ProductAffectedFixed inHide Price Until Loginbefore 1.1.21.1.2
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known