EUVD-2026-41255
GHSA-hhpx-jgxv-4x4j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Open self-registration removes any privilege barrier (PR:N); network-accessible web plugin with no complexity or user interaction; low C and I for content access and subscription state manipulation only.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership subscription, allowing unauthenticated users (after self-registering an account through the open registration flow) to obtain an active subscription on any paid plan without paying and access the gated content.
AnalysisAI
Payment enforcement bypass in the User Registration & Membership WordPress plugin before 5.2.0 allows any visitor to self-register a free account and then activate a paid membership subscription without completing payment, gaining unauthorized access to gated premium content. The flaw is a business logic failure: the plugin activates the paid plan upon subscription initiation rather than upon confirmed payment receipt. No public exploit or CISA KEV listing exists at time of analysis, but exploitation is trivially low-effort given the plugin's open registration model and the CVSS vector of AV:N/AC:L/PR:N/UI:N.
Technical ContextAI
The affected component is the 'User Registration & Membership' WordPress plugin (versions prior to 5.2.0), which provides self-service account registration combined with paid membership tier management. The vulnerability is a business logic flaw - classified generically as CWE N/A in available data, though it aligns conceptually with CWE-840 (Business Logic Errors) and CWE-285 (Improper Authorization). The plugin's subscription activation routine fails to gate plan enablement behind a verified payment callback or confirmation event. Instead, membership status is elevated during or immediately after a paid plan is selected, before any payment gateway confirmation is received. This is a server-side state transition error independent of the payment provider used. Affected CPE is implicit from EUVD data: the plugin slug 'user-registration' by wpeverest, all releases from 0 up to but not including 5.2.0.
RemediationAI
Update the User Registration & Membership plugin to version 5.2.0 or later immediately; this is the vendor-confirmed patched release per the WPScan advisory (https://wpscan.com/vulnerability/49f4c59e-5931-405d-8518-244531bbc889/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-11965). Updates can be applied via the WordPress admin dashboard under Plugins > Installed Plugins > Update. If an immediate update is not feasible, a compensating control is to temporarily disable paid membership plan registration and restrict the open registration flow to free tiers only; note this will prevent new legitimate paid sign-ups and may require manual enrollment of paying users until the patch is applied. Site owners should also audit existing accounts created since their oldest installed vulnerable version to identify any accounts with active paid memberships that have no corresponding payment record, as those may represent exploitation of this vulnerability.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today