CVE-2026-110030

MediumCVSS 5.3/10Last modified Oct 29, 2026

Description

The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
UnknownHide Price Until Login< 1.1.2

References

Timeline

Published
Oct 29, 2026
Last modified
Oct 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1100317.2The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitraCVE-2026-1100325.5The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the cCVE-2026-1100336.8The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and wrCVE-2026-1100343.7The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from aCVE-2026-1100354.3The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authCVE-2026-1100363.3A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool toCVE-2026-1100375.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-1100392.7The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an aCVE-2026-110045.3Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obCVE-2026-1100413.8The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachmentCVE-2026-1100424.9The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuratCVE-2026-1100438.8Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-110030: Medium severity, CVSS 5.3 | Vulnix