CVE-2026-92978

The User Registration & Membership plugin for WordPress (versions up to and including 5.2.8 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is missing or incorrect nonce validation on the trigger_bulk_action() function. Specifically, an attacker can bypass nonce chec...