User Registration & Membership CVE-2026-16736

The target site must have the User Registration & Membership plugin installed and active with a version prior to 5.2.6. Critically, the vulnerability only matters when the administrator has enabled the registration-disabled setting - sites with open registration are unaffected because the bypass reproduces behavior that would occur anyway. No authentication is required (PR:N per CVSS), no user interaction is needed, and no special network position is necessary beyond standard HTTP access to the site. Exploitation is limited by: (1) the site must use this specific plugin rather than WordPress core registration; (2) the actual damage is bounded by what permissions newly registered users receive - sites that assign Subscriber-level roles with no privileged content present minimal risk; (3) a publicly available POC lowers the skill bar but EPSS data suggests exploitation has not yet become widespread.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 7.5 and accurately captures the low-friction, unauthenticated, network-reachable nature of the flaw. However, the C:H rating requires scrutiny: the primary tangible impact of unauthorized account creation is access to member-only content, which may or may not represent genuinely sensitive data depending on the site's purpose - C:H may be overstated for sites with no privileged member content. The omission of I:L in the NVD vector is also questionable, since unauthorized writes to the WordPress user table are an integrity violation. EPSS at 0.15% (4th percentile) contrasts with the available POC, suggesting exploitation remains opportunistic rather than widespread. Real-world priority should be elevated on sites where membership grants access to sensitive content, paid features, or elevated WordPress roles (e.g., Contributor or Author), and lower on informational-only sites with no meaningful member tier.

An attacker identifies a WordPress site running the User Registration & Membership plugin where registration appears disabled (no public registration link shown). Using the publicly available POC from WPScan, the attacker directly submits a crafted POST request to the plugin's registration handler endpoint, bypassing the UI-level restriction. The server creates a valid WordPress account, granting the attacker access to member-only content, paid resources, or any role automatically assigned to new registrants.