EUVD-2026-43285
GHSA-6f2x-47pc-8mpq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote webhook forgery (AV:N/AC:L/PR:N/UI:N); primary impact is integrity from activating memberships (I:H), with only limited confidentiality from gained content access (C:L) and no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
Articles & Coverage 2
AnalysisAI
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated attackers forge a payment-provider webhook to mark a subscription as paid, activating premium memberships without any real transaction. WPScan reports publicly available exploit code, though there is no public exploit identified as being used in active attacks (not in CISA KEV). The core weakness is that inbound webhook notifications are trusted and acted upon without authenticating their origin or signature.
Technical ContextAI
The plugin implements paid membership tiers on WordPress sites and relies on asynchronous webhook callbacks from payment providers (e.g. PayPal/Stripe-style IPN or webhook events) to confirm that a subscriber has paid. Payment webhooks are designed to be verified either by validating a provider-signed signature/HMAC header or by performing a server-to-server callback to the provider to confirm the event. This vulnerability is a classic insufficient-verification-of-data-authenticity flaw (CWE-345, and specifically CWE-347 improper verification of a cryptographic signature) - the endpoint that receives 'payment approved' events does not confirm the request genuinely originated from the payment provider, so any HTTP client can POST a crafted event. The CPE 'cpe:2.3:a:unknown:user_registration_&_membership:*' with a version boundary of <5.2.2 identifies all releases up to but not including 5.2.2 as affected.
RemediationAI
Vendor-released patch: upgrade the User Registration & Membership plugin to version 5.2.2 or later, which is available from the vendor per the WPScan advisory (https://wpscan.com/vulnerability/faf55649-8f76-4abf-a6b9-0d0774e22d29/). Until the update can be applied, restrict access to the plugin's payment/webhook callback endpoint so it is only reachable from your payment provider's published IP ranges (a firewall/WAF allowlist), accepting that provider IP changes could break legitimate callbacks and require maintenance. As an additional interim control, monitor for membership activations that lack a corresponding real transaction in your payment-provider dashboard and reconcile/reverse fraudulent subscriptions; if feasible, temporarily disable automatic webhook-driven activation and require manual approval, at the cost of onboarding delay. Do not rely on obscuring the endpoint URL alone, as the endpoint is reachable by any unauthenticated client.
More in User Registration Membership
View allThe User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their accou
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors s
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-priv
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allow
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holdin
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) expo
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any auth
Deserialization of Untrusted Data vulnerability in WPEverest User Registration.3.2.1. Rated high severity (CVSS 7.4), th
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln
The User Registration - Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today