User Registration & Membership EUVD-2026-43285

The specific prerequisite is that the site runs the User Registration & Membership plugin (before 5.2.2) with paid membership/subscription functionality enabled and its payment-provider webhook/callback endpoint exposed - which is the normal configuration for any site selling memberships. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no elevated privileges are required; the attacker only needs network reachability to the WordPress site's webhook endpoint. Limiting factors: the site must actually use the paid-membership/payment feature (sites using the plugin only for free registration are not monetizing and gain little attacker value), and the practical payoff is limited to obtaining membership access rather than server control.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) reflects a network-reachable, low-complexity, unauthenticated attack with no user interaction - highly favorable for an attacker. Publicly available exploit code raises practical risk, but the vulnerability is NOT in CISA KEV and no EPSS score was provided, so widespread automated exploitation is unproven. The real-world impact is primarily an integrity/business-logic bypass (fraudulent membership activation) rather than server compromise; the vendor-rated C:H likely reflects that a free-riding attacker gains access to paid/gated content, which is better characterized as limited confidentiality than full data disclosure. Note the tag 'Information Disclosure' conflicts somewhat with the actual described behavior (payment/authorization bypass) - treat the tag with caution. Net: a genuine, easily exploitable priority for any site monetizing memberships through this plugin, but the damage is revenue/access fraud, not RCE.

An attacker signs up (or targets an existing pending order) on a site running the vulnerable plugin, then sends a crafted HTTP POST to the plugin's payment webhook endpoint mimicking a 'payment approved' event for their account. Because the plugin does not verify the notification's authenticity, it activates the paid membership and grants access to gated content - with no payment made. Publicly available exploit code lowers the skill barrier for reproducing this.