User Registration & Membership EUVD-2026-22135

The target WordPress site must have the User Registration & Membership plugin installed, active, and at version 5.1.4 or earlier - the plugin's logout handler must be processing the redirect_to_on_logout GET parameter, which is enabled by default when the plugin is active. The victim must be authenticated (have an active WordPress session) at the moment the crafted URL is clicked, since the logout-and-redirect sequence only executes against a live session. No attacker authentication or elevated privileges are required - the malicious URL is constructed entirely externally. Exploitation is limited by the required active user interaction (UI:R per CVSS): the victim must click a specifically crafted link, making fully automated mass exploitation impractical and consistent with SSVC's 'Automatable: no' rating. The attack has no dependency on server configuration beyond plugin activation.

CVSS 6.1 (Medium) with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N correctly characterizes the network exposure and changed scope, but real-world priority signals are consistently lower than the score implies. EPSS at 0.03% (7th percentile) reflects negligible observed exploitation probability across the vulnerability population. CISA SSVC rates exploitation as 'none', the attack as non-automatable, and technical impact as 'partial' - meaning automated mass exploitation is not considered feasible and no confirmed active exploitation exists. The vulnerability does not appear in CISA KEV. The mandatory user interaction (UI:R) - a victim must click a socially-engineered logout link while authenticated - is the primary limiting factor, making this a phishing-amplification primitive rather than a direct exploit. The publicly available POC slightly elevates risk above baseline, but combined signals indicate this is a patch-on-next-cycle issue for most organizations rather than an emergency response priority.

An attacker constructs a URL such as https://victim-site.com/?ur_logout=true&redirect_to_on_logout=https://attacker-phishing-site.com and distributes it via email, forum post, or embedded link. A logged-in WordPress user who clicks the link is silently logged out by the plugin and immediately redirected to the attacker-controlled domain, where they may be presented with a convincing replica of the login page to harvest credentials. A publicly available POC confirms this redirect behavior is exploitable as described.