User Registration Membership Free Paid Memberships Subscriptions Content Restriction User Profile Custom User Registration Login Builder EUVD-2026-20444

The vulnerability is a classic SQL Injection (CWE-89) arising from improper input validation and parameterization in database queries. The 'membership_ids[]' parameter, likely used to filter memberships in user registration workflows, is passed directly into SQL queries without adequate escaping or prepared statement binding. WordPress plugins typically interact with the wpdb API; the root cause appears to be direct string concatenation or use of inadequate escaping functions (e.g., esc_attr() instead of database-layer sanitization) rather than parameterized queries using placeholders. The plugin (CPE: cpe:2.3:a:wpeverest:user_registration_&_membership - free & paid memberships, subscriptions, content_restriction, user_profile, custom_user_registration & login_builder) affects the core membership filtering logic, exposing the WordPress user database to unauthorized SELECT operations by any Subscriber or higher-privileged authenticated user.