67 matches found
CVE-2026-1492
CVE-2026-1492 User Registration & Membership = 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration π΄ Vulnerability Overview CVE-2026-1492 β Unauthenticated Privilege Escalation via Membership Registration Description: The User Registration & Membership plugin for WordPress is...
CVE-2025-2563
CVE-2025-2563 User Registration & Membership = 4.1.1 - Escalada de privilegios no autenticada Β‘Aviso legal! La informaciΓ³n presentada en este informe de CVE Common Vulnerabilities and Exposures tiene fines exclusivamente educativos e informativos. Los detalles proporcionados se basan en recursos...
CVE-2026-86407
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-86407 User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-80072
The User Registration & Membership WordPress plugin, in versions before 5.2.8 , is vulnerable to an unauthenticated open redirect . The flaw exists because the plugin fails to validate the destination of a post-login redirect, allowing an attacker to redirect visitors to an arbitrary external URL...
CVE-2026-86406 User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...
EUVD-2026-76953
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...
CVE-2026-86406 User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...
CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...
EUVD-2026-76952
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...
CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...
PT-2026-90794
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-80072: URL Redirection to Untrusted Site
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...
CVE-2026-80071: Improper Privilege Management
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...
CVE-2026-86406: Improper Privilege Management
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...
CVE-2026-86407: Exposure of Sensitive Information to an Unauthorized Actor
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-79996
The User Registration & Membership WordPress plugin, in versions prior to 5.2.6 , is vulnerable to an authenticated privilege escalation flaw. The root cause is a missing capability check when saving login settings. This allows authenticated users with management capabilities (but without full ad...
CVE-2026-79996 User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...
CVE-2026-79996: Improper Privilege Management
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...
CVE-2026-79995: Authorization Bypass Through User-Controlled Key
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...