EUVD-2026-76955
GHSA-wr2r-r9vc-rr7g
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Non-default smart-tag configuration required for data exposure justifies AC:H; unauthenticated network access with low confidentiality impact only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.
AnalysisAI
Unauthenticated information disclosure in the User Registration & Membership WordPress plugin (versions 5.0 through 5.2.7) exposes arbitrary users' email addresses, profile fields, roles, and membership order details to any visitor. The plugin's membership confirmation page performs no ownership verification - an attacker who supplies another user's identifier in the request receives that user's data if the site operator has configured user smart tags on the page's message template. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the target site must be running User Registration & Membership plugin version 5.0 through 5.2.7, AND (2) the site administrator must have explicitly added one or more 'user smart tag' placeholders to the membership confirmation page's configurable message - a non-default configuration that is NOT present in the plugin's shipped defaults. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N = 3.7) is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: version 5.2.8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in User Registration Membership
View allThe User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their accou
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated att
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors s
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-priv
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows an
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allow
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user h
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holdin
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) expo
Open redirect in the User Registration & Membership WordPress plugin before 5.2.8 permits unauthenticated attackers to c
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any auth
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today