User Registration & Membership CVE-2026-1869

No special attacker-side conditions are required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a fully remote, unauthenticated attack with low complexity against default-reachable endpoints. The sole prerequisite is that the target WordPress site has the User Registration & Membership plugin installed, active, and configured with at least one paid membership plan, since confirm_payment() is only relevant when paid memberships are enabled. The vulnerability is limited to sites where the paid membership feature is in use; sites using only the free/registration features do not expose the vulnerable payment confirmation code path. Exploitation is constrained to the membership activation outcome - attackers cannot achieve remote code execution, read arbitrary files, or escalate to WordPress admin via this flaw alone.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) scores 6.5 (Medium), reflecting that exploitation is fully network-accessible, requires no authentication, and involves no user interaction or special conditions - a straightforward risk profile. The business impact, however, may substantially exceed what the CVSS score conveys: for site operators whose revenue model depends on paid membership subscriptions, unauthenticated payment bypass represents a direct and repeatable financial loss, not merely a data-integrity concern. No EPSS score was provided in the source data; however, given the low attack complexity and zero authentication barrier, exploitation probability should be treated as elevated for sites running vulnerable versions. The vulnerability is not listed in CISA KEV and no POC is publicly documented at time of analysis, which moderates immediate mass-exploitation concern. No conflicting signals between CVSS vector and description - both indicate fully unauthenticated network exploitation.

An unauthenticated attacker identifies a WordPress site running the vulnerable plugin by detecting standard WordPress membership registration pages. The attacker crafts and submits a direct HTTP POST request to the confirm_payment() endpoint, supplying a membership plan identifier but omitting or forging payment confirmation data that the function fails to validate. The server-side function processes the request, marks the membership as paid and active in the WordPress database, and grants the attacker full access to restricted paid content or services without any financial transaction occurring.