wp-user-registration-vuln-checker

针对 CVE-2026-1492 的 WordPress 用户注册检查器 用于检查可能受 User Registration & Membership 插件中 CVE-2026-1492 影响的自有 WordPress 站点的只读检查器。 它帮助站点所有者确认插件暴露情况，并寻找失陷指标，例如隐藏的管理员账户、可疑上传、计划任务条目和被篡改的文件。 从这里开始 需求| 链接 ---|--- 浏览工具页面| https://limo57640-crypto.github.io/wp-user-registration-vuln-checker/ 阅读 Ping7 自检指南|...

CVE-2026-80072

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

CVE-2026-80071

The User Registration & Membership WordPress plugin (versions before 5.2.8 ) is vulnerable to privilege escalation. The flaw exists because the plugin fails to properly restrict who can author a membership plan and lacks validation for the plans users attach to their own accounts. This allows aut...

PT-2026-84026

Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-79995

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...

CVE-2026-79996

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

EUVD-2026-67574

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...

PT-2026-82889

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

PT-2026-81230

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript conte...

CVE-2026-77129: Improper Neutralization of Special Elements Used in a Template Engine

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript conte...

CVE-2026-14823 Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not...

CVE-2026-14822

The Event Tickets and Registration WordPress plugin (versions before 5.29.0.1 ) contains an improper access control vulnerability. The plugin fails to perform authorization checks on one of its order-management REST endpoints , which allows unauthenticated users to manipulate the status of existi...

WordPress Event Tickets and Registration plugin < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification vulnerability

Contributor+ Seating Layout and Ticket Inventory Modification vulnerability discovered by Shivamani Vastrala in WordPress Plugin Event Tickets versions 5.29.0.1...

PT-2026-67048

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...

📄 WordPress WooCommerce Simple Registration 1.5.6 Unauthenticated Privilege Escalation

WordPress WooCommerce Simple Registration plugin version 1.5.6 contains an unauthenticated privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrates the...

PT-2026-60723

The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pendin...

PT-2026-52683

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm payment function in all...

CVE-2026-25425 WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration = 5.1.2 versions...

CVE-2026-25425 WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration = 5.1.2 versions...

CVE-2026-6145

The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5. This is due to the isadmincreationprocess method relying solely on the presence of action=createuser in the $REQUEST superglobal without performing any...