---
title: "Subscriber Level Vulnerability: 15 Bugs in One Week"
slug: "subscriber-level-vulnerability-open-registration"
description: "A subscriber level vulnerability needs only a free account. We found 15 high-severity ones in one week. Here is what to patch first."
date: 2026-10-18
author: "WP Vanguard Team"
category: "Research"
tags: ["subscriber-level-vulnerability", "cve-2026-104932", "cve-2026-93953", "open-registration", "search-regex", "backuply"]
featured_image: "/images/blog/subscriber-level-vulnerability-open-registration.jpg"
palette: "high"
---

Between October 11 and October 18, 2026, our database logged 15 high-severity plugin disclosures whose titles say the attacker needs only a Subscriber or Contributor account. That is a subscriber level vulnerability in the plainest sense: no stolen admin password, no leaked key, just a free sign-up form. Thirteen of the 15 need Subscriber. The other two need Contributor.

If your site lets visitors register, that sign-up form is part of your attack surface. This post walks through the week's list, reads the actual fixes for the two biggest names (Backuply and Search Regex), and ends with a short plan for communities, LMS sites, membership sites and stores with customer accounts.

```bars
{"title": "High-severity disclosures by bug class", "highlight": "Priv. escalation", "data": [
  {"label": "Priv. escalation", "value": 4, "display": "4"},
  {"label": "File upload", "value": 3, "display": "3"},
  {"label": "Code execution", "value": 3, "display": "3"},
  {"label": "Deletion", "value": 2, "display": "2"},
  {"label": "Other", "value": 3, "display": "3"}
]}
```

## What the Week Looked Like

We queried the production vulnerability table for critical and high disclosures published October 11 through October 18 whose title names Subscriber+, Customer+ or Contributor+. It returned 15 rows. None is rated critical: CVSS scores run from 7.5 to 8.8, so every row is "high".

Sorted by class, privilege escalation leads with four, then file upload and remote code execution with three each, arbitrary deletion with two, and three singletons: a SQL injection, an arbitrary shortcode execution and a local file inclusion. The "Other" bar above is those three.

Every row carries a fixed version in our database. That matters for the advice below, because for this week the answer is almost always "update", not "remove".

| Plugin | Role needed | Class | CVSS | Installs | Fixed in |
|---|---|---|---|---|---|
| Backuply | Subscriber | Second-order SQL injection | 8.0 | 600,000+ | 1.5.9 |
| Search Regex | Subscriber | Remote code execution | 8.0 | 100,000+ | 3.5.1 |
| Checkout Field Manager for WooCommerce | Subscriber | Arbitrary media deletion | 8.1 | 80,000+ | 7.9.7 |
| User Registration & Membership | Subscriber | Arbitrary shortcode execution | 8.1 | 50,000+ | 5.3.0 |
| InstaWP Connect | Subscriber | Privilege escalation, API key disclosure | 7.5 | 40,000+ | 0.1.4.2 |
| Directorist | Subscriber | Arbitrary listing deletion | 8.1 | 20,000+ | 8.10.3 |
| FV Flowplayer Video Player | Subscriber | Arbitrary file upload | 8.8 | 10,000+ | 7.5.55.7212 |
| YaySMTP | Subscriber | Arbitrary file upload | 8.8 | 10,000+ | 2.7.8 |
| Nexter Extension | Subscriber | Privilege escalation | 7.5 | 10,000+ | 4.7.12 |
| LifterLMS | Contributor | Local file inclusion | 7.5 | 10,000+ | 10.3.2 |
| affiliate-toolkit Starter | Contributor | Remote code execution | 8.8 | 2,000+ | 3.9.1 |
| PilotPress | Subscriber | Account takeover | 8.8 | 900+ | 2.0.44 |
| Membership & User Roles for WooCommerce | Subscriber | Privilege escalation | 7.5 | 300+ | 20261007 |
| DoubleScale CRM | Subscriber | Arbitrary file upload | 8.8 | 60+ | 1.6.0 |
| Email Customizer for WooCommerce (Pro) | Subscriber | Remote code execution | 8.8 | Premium | 3.9.6 |

Install counts come from the WordPress.org plugins API on October 18 and are the directory's rounded buckets, not exact numbers. The 14 plugins listed there add up to roughly 933,000 active installs, though sites overlap. Email Customizer is a premium plugin with no directory listing, so it has no count.

## Why a Subscriber Level Vulnerability Matters on Open Sites

A subscriber account is the lowest real login WordPress has, and it's the default role for new registrations. On a blog with registration off, that role may have zero holders. On a community, a course site or a store, it can have thousands, and anyone can mint one in a minute.

What can that account touch? Anything a plugin exposes to "logged in" instead of "can do this". That includes admin-ajax actions, REST routes, profile and account forms, upload fields, support-ticket attachments and any field that ends up in user meta. Most of this week's bugs sit in that gap: the developer checked that the visitor was logged in, but not that the visitor was allowed.

Authorization bugs are a big slice of what we log. In our [booking plugin analysis](/blog/booking-plugin-vulnerabilities), 45% of that category's disclosures were authorization bugs, against 25% across all plugins. A registration form hands attackers the one precondition these bugs want. For the wider picture see [how WordPress sites get hacked](/blog/how-wordpress-sites-get-hacked).

> [!KEY]
> A "Subscriber+" bug is an unauthenticated bug with one extra step, and on a site with open registration that step costs nothing. Rate these by who can sign up, not by the label.

Two caveats. A Subscriber+ rating doesn't mean the bug works on every install; some need a particular plugin feature switched on. And a site with registration closed is much safer against this class, though not immune if an attacker already holds any account.

## What the Backuply Fix Shows

Backuply, at about 600,000 installs, is the largest plugin on the list. Wordfence's advisory (CVE-2026-93953) covers versions up to 1.5.8, scores it 8.0, and describes a second-order SQL injection: a subscriber plants a payload in profile data, and it runs later when an administrator restores a backup. Version 1.5.9 shipped on October 1, 14 days before the advisory went public. Its changelog lists a "Security Fix" for the restoration process credited to a Wordfence researcher.

We diffed 1.5.8 against 1.5.9 in the WordPress.org repository. The meaningful change is in `restore_ins.php`, the file that replays the SQL dump. The restore code looks for the table prefix of the backup by matching a pattern against each statement. In 1.5.8 that pattern wasn't anchored to the start of a real `CREATE TABLE` statement. The developers' own new comment says why it matters: user data inside INSERT statements can contain text that looks like `CREATE TABLE ... options (`.

So a profile field holding that text can overwrite the prefix variable, and the restore then concatenates that variable into an `UPDATE` query. In 1.5.9 the pattern is anchored, accepts only identifier characters, and the version string in that query is stripped to digits, letters, dots and hyphens.

We read the patch. We didn't build an exploit, so the chain above is our reading of the diff and Wordfence's description, not a reproduction. The shape is the useful part: the subscriber never touches the vulnerable code. An administrator does, on restore day, which makes the bug easy to miss in logs.

## What the Search Regex Fix Shows

Search Regex (CVE-2026-104932) is at 100,000+ installs. Wordfence lists version 3.5 as affected and rates it 8.0: a subscriber corrupts a serialized user-meta string and gets remote code execution. Version 3.5 came out on October 5, and 3.5.1 followed on October 6. The advisory landed nine days later.

The 3.5.1 changelog gives the fix in four lines: "Fix security issue with serialized user meta (found by R3D)", "Don't allow serialized data to be saved (partial serialized support is removed)", and two shortcode fixes. The diff matches. The old replace routine rewrote the length counters inside serialized strings after a replacement. The new code deletes that routine, and the meta writer now returns an error for any serialized value, noting that WordPress will unserialize it the next time the meta is read.

The patch also swaps the fixed `<SEARCHREGEX>` marker for a random one per run, so stored content can't contain it, and limits shortcode processing to the replacement text alone. The object-handling side of this is covered in our [unserialize fixes write-up](/blog/wordpress-unserialize-vulnerability-three-fixes); here, the point is the entry route. User meta is writable by the user, and an admin tool later trusted it.

Both anchors share a trait. The subscriber plants data and waits. The dangerous code runs later, under someone else's privileges.

## What to Do on a Site With Open Registration

Start with the patch list. Compare your plugin versions against the "Fixed in" column. Anything on or above that number has this week's fix. Because every row has a fix, updating is enough, and our weekly [patch list](/blog/wordpress-plugins-to-patch-this-week) tracks the critical and high items beyond this class.

Then review the door itself:

- Check whether registration needs to be open. In Settings, General, "Anyone can register" controls it. If you run a store, ask whether guest checkout would do instead of accounts.
- Confirm the default role. Settings, General, "New User Default Role" should be Subscriber or Customer, never anything higher.
- Remove plugins you don't use. A deactivated plugin's files are still on disk; delete them.
- Stop treating Contributor as harmless. Two entries this week, LifterLMS and affiliate-toolkit, start at that role.

Next, watch the accounts. From a shell, list the newest ones:

```bash
wp user list --role=subscriber --orderby=registered --order=DESC \
  --fields=ID,user_login,user_email,user_registered --number=20
wp option get users_can_register
wp option get default_role
```

A burst of sign-ups with random names or throwaway domains, especially right after a disclosure, deserves a look. Add email verification or a CAPTCHA to the registration form if bursts keep happening. Our [security checklist](/blog/wordpress-security-checklist) covers the rest of the baseline, and [monitoring tools](/blog/free-wordpress-security-monitoring-tools) can alert on new users and changed files.

Finally, if a subscriber-level bug was live on your site before you patched, don't stop at the update. Check for unknown administrators and unexpected files in uploads, and read [the signs your site was hacked](/blog/signs-wordpress-site-hacked).

## Method and Limits

The list comes from our production `vulnerabilities` table: severity critical or high, published 2026-10-11 through 2026-10-18, title containing Subscriber, Customer+ or Contributor+. It returned 15 rows and no Customer+ titles. Disclosures that don't state the role in the title, or rate medium, aren't here. The class counts are our grouping of the Wordfence titles.

The diffs come from the public WordPress.org repository (Backuply 1.5.8 to 1.5.9, Search Regex 3.5 to 3.5.1). The other 13 fixes we haven't diffed, so for those we rely on the advisory titles.

Want to know where your own site stands? Run a free surface scan at [WP Vanguard](/) and we'll check your installed plugin versions against this database.

## References

- [Wordfence Intelligence: Backuply <= 1.5.8, Second-Order SQL Injection (CVE-2026-93953)](https://www.wordfence.com/threat-intel/vulnerabilities/id/202a2d02-a069-43d1-9ebe-59828e828c03)
- [Wordfence Intelligence: Search Regex 3.5, Remote Code Execution (CVE-2026-104932)](https://www.wordfence.com/threat-intel/vulnerabilities/id/cb801c72-0e50-4df1-88cc-30f8037c6d3c)
- [Backuply on WordPress.org](https://wordpress.org/plugins/backuply/#developers)
- [Search Regex on WordPress.org](https://wordpress.org/plugins/search-regex/#developers)
- [WordPress.org plugins API](https://api.wordpress.org/plugins/info/1.2/)
- [WordPress documentation: Roles and Capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)