67 matches found
CVE-2026-1492
CVE-2026-1492 User Registration & Membership = 5.1.2 - 멤버십 등록을 통한 인증되지 않은 권한 상승 🔴 취약점 개요 CVE-2026-1492 — 멤버십 등록을 통한 인증되지 않은 권한 상승 필드| 세부 정보 ---|--- CVE ID| CVE-2026-1492 심각도| 치명적 — CVSS v3.1 점수: 9.8 벡터| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence 영향받는 소프트웨어| User Registration &...
CVE-2025-2563
CVE-2025-2563 User Registration & Membership = 4.1.1 — Неавторизованное повышение привилегий Отказ от ответственности! Информация, представленная в данном описании CVE Common Vulnerabilities and Exposures, предназначена исключительно для образовательных и информационных целей. Предоставленные...
CVE-2026-86407
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-86407 User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-80072
The User Registration & Membership WordPress plugin, in versions before 5.2.8 , is vulnerable to an unauthenticated open redirect . The flaw exists because the plugin fails to validate the destination of a post-login redirect, allowing an attacker to redirect visitors to an arbitrary external URL...
CVE-2026-86406 User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...
EUVD-2026-76953
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...
CVE-2026-86406 User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...
CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...
EUVD-2026-76952
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...
CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...
CVE-2026-80072: URL Redirection to Untrusted Site
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...
CVE-2026-80071: Improper Privilege Management
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...
PT-2026-90794
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-86406: Improper Privilege Management
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...
CVE-2026-86407: Exposure of Sensitive Information to an Unauthorized Actor
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-79996
The User Registration & Membership WordPress plugin, in versions prior to 5.2.6 , is vulnerable to an authenticated privilege escalation flaw. The root cause is a missing capability check when saving login settings. This allows authenticated users with management capabilities (but without full ad...
CVE-2026-79996 User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...
CVE-2026-79996: Improper Privilege Management
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...
CVE-2026-79995: Authorization Bypass Through User-Controlled Key
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...