The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1)

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• devbits register-plusup to 3.5.1 inclusive
• devbits register-plus1.1
• devbits register-plus1.2
• devbits register-plus2.0
• devbits register-plus2.1
• devbits register-plus2.2
• devbits register-plus2.3
• devbits register-plus2.4
• devbits register-plus2.5
• devbits register-plus2.6
• devbits register-plus2.7
• devbits register-plus2.8
• devbits register-plus2.9
• devbits register-plus3.0
• devbits register-plus3.0.1
• devbits register-plus3.0.2
• devbits register-plus3.1
• devbits register-plus3.2
• devbits register-plus3.3
• devbits register-plus3.4

Other highest-scoring records for the same primary product.

• CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionKEV
  72This week
• CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the KEV
  68This week
• CVE-2019-8942WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an a
  60This week
• CVE-2022-21661SQL injection in WordPress
  59Plan
• CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryKEV
  55Plan
• CVE-2017-1001000The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before
  55Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.