CVE-2026-86407

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...

CVE-2026-86407

The User Registration & Membership WordPress plugin before 5.2.8 fails to verify that a visitor requesting its membership confirmation (thank you) page actually owns the account named in the request or that any registration/purchase occurred. This allows unauthenticated users to retrieve another ...

EUVD-2026-76955

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...