CVE-2026-92978

The User Registration & Membership plugin for WordPress (versions up to and including 5.2.8 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is missing or incorrect nonce validation on the trigger_bulk_action() function. Specifically, an attacker can bypass nonce chec...

EUVD-2026-103227

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

WordPress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() vulnerability

Cross-Site Request Forgery to triggerbulkaction vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin User Registration versions = 5.2.8...