User Registration CVE-2026-92978

Exploitation requires an authenticated administrator with an active session to be tricked into clicking an attacker-controlled link or visiting a malicious page (UI:R / active user interaction); the attacker themselves needs no account (PR:N). The concrete technical prerequisite is supplying an empty new_role parameter so that trigger_query_actions() returns early and hands off to the unprotected trigger_bulk_action() handler, bypassing both the plugin's and WordPress core's bulk-users nonce validation. Limiting factors: the site must run the User Registration & Membership plugin version ≤5.2.8, an administrator must be logged in and actively interact with the forged request, and impact is confined to approving/denying user registrations (no data disclosure or site takeover).

This is a genuine but low-severity issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) is internally consistent with the CWE-352 CSRF classification and the description: an unauthenticated attacker can send the request, but exploitation is gated on user interaction (UI:R) - specifically tricking a logged-in administrator into clicking a link - and impact is limited to Integrity (I:L), with no confidentiality or availability loss. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the signals do not conflict, they simply all point to modest real-world priority. The only elevating nuance is the specific bypass detailed in the description (an empty new_role parameter causes trigger_query_actions() to return early and cede control to the unprotected trigger_bulk_action(), whose exit() also suppresses WordPress core's own nonce check), which makes the flaw reliably reachable rather than theoretical. Net: a real vulnerability worth patching, but not an emergency - it is a UI-dependent CSRF affecting integrity of user-registration approvals, not a widespread automatable compromise.

An attacker crafts a malicious web page or email link that silently submits a forged bulk-action request to a target WordPress site, and lures a logged-in administrator into visiting it. Because the empty new_role parameter bypasses the nonce check, the forged request executes, letting the attacker approve pending registrations or deny/lock out arbitrary user accounts. No public proof-of-concept exploit was provided in the input.