What is the CVSS score of CVE-2026-1869?

CVE-2026-1869 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

User Registration & Membership CVE-2026-1869

EUVD-2026-39639 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 Wordfence

GHSA-97gw-4hgp-77mp

WordPress Authentication Bypass User Registration Membership Free Paid Memberships Subscriptions Content Restriction User Profile Custom User Registration Login Builder Wordpress Plugin Wpeverest

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible with no auth or interaction; integrity impact from unauthorized membership activation; low confidentiality from accessing gated content; no availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 09:15 vuln.today

CVE Published

Jun 26, 2026 - 07:54 cve.org

MEDIUM 6.5

DescriptionCVE.org

The User Registration & Membership - Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm_payment() function in all versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to bypass payment processing and activate paid memberships.

AnalysisAI

Payment bypass in WPEverest's User Registration & Membership WordPress plugin (versions up to and including 5.2.0) allows unauthenticated remote attackers to activate paid memberships without completing payment. The vulnerability stems from missing authorization checks in the confirm_payment() function (CWE-862), which fails to validate that a legitimate payment transaction occurred before granting membership access. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack is low-complexity and requires no authentication, making it trivially reachable by any internet-connected adversary.

Technical ContextAI

The affected component is the confirm_payment() function within the WPEverest User Registration & Membership plugin (CPE: cpe:2.3:a:wpeverest:user_registration_&_membership_...:*). CWE-862 (Missing Authorization) indicates the function executes a privileged state change - activating a paid membership - without first verifying that the caller has actually completed a valid payment transaction. This is a server-side authorization flaw, not a client-side bypass: the function likely processes a payment confirmation callback (e.g., from a payment gateway webhook or a return URL) but does not cryptographically verify the payment provider's signature or validate the transaction status server-to-server before updating membership state in the WordPress database.

RemediationAI

Update the User Registration & Membership plugin to the version released after 5.2.0, as indicated by the patch changeset available at https://plugins.trac.wordpress.org/changeset/3552000/user-registration; the exact patched release version is not independently confirmed beyond the changeset reference, so administrators should verify the latest available version in the WordPress plugin repository. If immediate upgrade is not possible, the most actionable compensating control is to disable or deactivate the payment/paid membership functionality within the plugin settings until the patch is applied - this removes the vulnerable code path from the attack surface at the cost of disrupting paid subscription workflows. Additionally, consider restricting access to payment confirmation endpoints via WAF rules that validate known payment gateway IP ranges, reducing the population of requestors who can reach confirm_payment(). No side-effect-free workaround exists that preserves full paid membership functionality while the flaw is unpatched.