{"id":"CVE-2026-110030","kind":"vulnerability","aliases":["CVE-2026-110030"],"related":[],"title":"Hide Price Until Login WordPress plugin lets anyone register accounts","description":"The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.","summary":"The Hide Price Until Login WordPress plugin before 1.1.2 has a guest-registration handler that ignores the site's user-registration setting. An anonymous visitor can create a WordPress account and get a logged-in session even when registration is turned off.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-1.1.2-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; the sources do not name a file path or command.\n- Check Settings > General for the 'Anyone can register' option to see whether registration is disabled on the site.\n- Review recently created user accounts under Users for unexpected subscribers.","fix":"- Update the Hide Price Until Login plugin to `1.1.2` or later.","status":"open","published_at":"2026-10-29T06:17:18+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:55+00:00","updated_at":"2026-10-29T06:54:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T06:54:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Hide Price Until Login plugin to `1.1.2` or later.","reach":"internet","title":"Hide Price Until Login WordPress plugin lets anyone register accounts","impact":"medium","summary":"The Hide Price Until Login WordPress plugin before 1.1.2 has a guest-registration handler that ignores the site's user-registration setting. An anonymous visitor can create a WordPress account and get a logged-in session even when registration is turned off.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"anyone creates a logged-in account despite registration being disabled","analyst_note":"Confirm whether the handler is reachable only when the plugin is active and whether the sources identify the exact affected endpoint; the NVD entry gives no CVSS score.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; the sources do not name a file path or command.\n- Check Settings > General for the 'Anyone can register' option to see whether registration is disabled on the site.\n- Review recently created user accounts under Users for unexpected subscribers.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-1.1.2-or-later"],"who_is_affected":"Sites running the Hide Price Until Login plugin before 1.1.2 are exposed, since the flaw is in the plugin's guest-registration handler and bypasses the site's registration setting. Sites that do not run this plugin are not affected. Sites where the plugin is installed but deactivated are unlikely to expose the handler, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4108,"output_tokens":643,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110030':13A,16A '-2026':12A,15A '1.1.2':29B,73C 'account':10A,52B,99C 'allow':93C 'anonym':46B 'anyon':8A,94C 'creat':49B,96C 'cve':11A,14A 'disabl':111C 'ecommerc':17B 'even':60B,107C 'get':54B 'guest':33B,79C 'guest-registr':32B,78C 'handler':35B,81C 'hide':1A,22B,66C 'honour':85C 'ignor':37B 'let':7A 'log':57B,104C 'logged-in':56B,103C 'login':4A,25B,69C 'obtain':101C 'packag':18B 'plugin':6A,27B,71C 'price':2A,23B,67C 'regist':9A 'registr':34B,43B,62B,80C,91C,109C 'restrict':76C 'session':59B,106C 'set':44B,92C 'site':39B,87C 'turn':64B 'user':42B,90C 'user-registr':41B,89C 'visitor':47B 'woocommerc':19B 'wordpress':5A,20B,26B,51B,70C,98C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Hide Price Until Login plugin before 1.1.2 are exposed, since the flaw is in the plugin's guest-registration handler and bypasses the site's registration setting. Sites that do not run this plugin are not affected. Sites where the plugin is installed but deactivated are unlikely to expose the handler, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110030","severity":null,"published_at":"2026-10-29T06:17:18+00:00","modified_at":"2026-10-29T06:17:18+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}