CVE-2026-73995

The CVSS 5.4 on this CVE is a trap. Because the affected role is labeled 'subscriber,' security teams will mentally categorise this as low-privilege, low-impact, and defer the patch. That is exactly the wrong response. Here's why. Broken authentication during user registration is foundational—it is the trust anchor for account ownership, email verification, and every privilege level above subscriber. A flaw in registration doesn't compromise a subscriber account; it poisons the identity pipeline that higher-privilege roles read from downstream. If this vulnerability allows session fixation, predictable tokens, or missing validation during account creation, the attack surface extends well beyond 'subscriber' privileges. The malicious actor who owns the registration endpoint owns the ability to seed malicious identity state into your system, which then propagates through session management, privilege assignment, and every workflow that trusts newly-created accounts. The low EPSS of 0.00345 does not indicate this is safe to ignore. Registration endpoints in plugins and modules are rarely fingerprinted by automated scanners because identifying the specific component version requires parsing the parent application's dependency tree. This means exploitation activity against registration flaws is systematically underreported to EPSS models. The low probability score reflects detection poverty, not actual attack difficulty. Version 5.2.6 marks a plugin in maintenance mode. Code paths that stop receiving active development become orphaned—their implicit security assumptions (how sessions are handled, how tokens are generated, what trust relationships exist) are never documented and rarely questioned by successors. The registration module in this plugin likely sat unreviewed through multiple main codebase updates, not because it was secure, but because nobody was looking. What you should do: treat any registration authentication flaw as a trust-anchor vulnerability regardless of the role label. Patch immediately—the exposure window compounds over time as ghost accounts accumulate and downstream identity graph corruption spreads. Check whether your security testing pipelines cover registration flows with the same rigor as login. If this plugin is in maintenance mode, evaluate whether you can replace it; orphaned registration code is technical debt that grows more dangerous the longer it persists.

Reviewed through automated stages and approved by a human before publication.