What is the CVSS score of EUVD-2026-30257?

EUVD-2026-30257 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

User Registration & Membership EUVD-2026-30257

| CVE-2026-6145 MEDIUM

Missing Authorization (CWE-862)

2026-05-14 security@wordfence.com

GHSA-v2w9-cqf4-gvp2

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 09:30 vuln.today

CVE Published

May 14, 2026 - 09:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5. This is due to the is_admin_creation_process() method relying solely on the presence of action=createuser in the $_REQUEST superglobal without performing any authentication or capability check. This makes it possible for unauthenticated attackers to bypass the admin approval requirement when registering new accounts via the fallback submission path.

AnalysisAI

The User Registration & Membership WordPress plugin through version 5.1.5 allows unauthenticated attackers to bypass admin approval requirements and register accounts directly by sending a crafted request with action=createuser parameter, exploiting missing authorization checks in the account creation process. The vulnerability affects all installations of the plugin with default or custom configurations where the admin approval feature is enabled. CVSS 5.3 reflects limited confidentiality impact but integrity compromise through unauthorized account creation.

Technical ContextAI

The vulnerability exists in the is_admin_creation_process() method of the User Registration & Membership plugin, which checks for the presence of the action=createuser parameter in the PHP $_REQUEST superglobal (which merges GET, POST, and COOKIE data) but fails to validate user authentication status or WordPress capability permissions before processing the request. CWE-862 (Missing Authorization) describes this class of flaw where the application performs an action that requires authorization but does not verify that the user is authorized to perform that action. The plugin's fallback submission path relies on this flawed check, allowing attackers to bypass the admin approval workflow entirely. The vulnerability is rooted in the assumption that the presence of a specific parameter is sufficient proof of authorization, a common anti-pattern in WordPress plugin development.

RemediationAI

Update the User Registration & Membership plugin to version 5.1.6 or later immediately. WordPress administrators should navigate to Plugins → Installed Plugins, locate User Registration & Membership, and click 'Update Now', or manually download the latest version from plugins.wordpress.org/plugins/user-registration/. For organizations unable to update immediately, implement network-level controls by blocking direct requests to the plugin's fallback submission endpoints using Web Application Firewall (WAF) rules targeting requests with action=createuser in the request body or query string, though this creates operational overhead and may not protect all submission paths. Additionally, disable user registration at the WordPress site level (Settings → General → Membership → Anyone can register) until the update is applied, which eliminates the attack surface entirely but prevents legitimate user signups. Apply the patch via WordPress Plugins page or direct FTP/SSH update; the Wordfence vulnerability record and WordPress.org plugin repository contain patch confirmation.