CVE-2026-86407

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...

CVE-2026-86407 User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...

CVE-2026-80072

The User Registration & Membership WordPress plugin before 5.2.8 fails to validate the destination of a post-login redirect, enabling unauthenticated attackers to send visitors to an arbitrary external URL. This open redirect vulnerability can be leveraged for phishing , luring users to a malicio...

CVE-2026-86406

The User Registration & Membership WordPress plugin (versions before 5.2.8 ) fails to check the capability of the user initiating a membership purchase and does not validate the submitted payment method or plan. This allows any authenticated user at the subscriber level to receive the WordPress r...

CVE-2026-86406 User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...

EUVD-2026-76953

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

EUVD-2026-76952

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - Escalada de Privilegios no Autenticada mediante Registro de Membresía 🔴 Resumen de la Vulnerabilidad CVE-2026-1492 — Escalada de Privilegios no Autenticada mediante Registro de Membresía Descripción: El plugin User Registration & Membership...

CVE-2025-2563

CVE-2025-2563 User Registration & Membership = 4.1.1 - 未认证权限提升 免责声明！ 本文档中提供的 CVE（通用漏洞与暴露）信息仅用于教育和参考目的。所提供细节基于作者对公开资源的检索、研究及分析。内容无意促进或鼓励任何非法活动，包括黑客攻击、漏洞利用或对系统的未授权访问。 作者对信息的任何滥用不承担任何责任。建议个人和组织负责任地应用这些知识，并遵守适用法律法规。强烈建议读者仅在获得适当授权的受控环境中测试漏洞。 本文档的作者和贡献者不支持或纵容恶意活动，并鼓励负责任的披露和道德黑客实践。 描述 在“User Registratio...

CVE-2026-79996

The User Registration & Membership WordPress plugin versions before 5.2.6 lack a capability check when saving login settings. An authenticated user with the plugin's management capability (but not full administrator access) can modify arbitrary site options to escalate privileges to administrator...

CVE-2026-74001

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

EUVD-2026-63314

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-74001

User Registration & Membership Pro is a WordPress plugin affected by an unauthenticated broken authentication vulnerability in versions ≤ 5.4.5 , enabling account takeover without any prior credentials. The flaw was discovered by 0xd4rk5id3 and carries a CVSS 3.1 score of 9.8 (CRITICAL) with a ne...

CVE-2026-74001 WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-11961 User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID

The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into ...

CVE-2026-11963

The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change...

CVE-2026-7651

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.5. This is due to missing...

CVE-2026-7651 User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.5. This is due to missing...