What is the CVSS score of EUVD-2026-53108?

EUVD-2026-53108 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of User Registration & Membership are affected by EUVD-2026-53108?

The User Registration & Membership WordPress plugin (versions before 5.2.6) contains a registration enforcement bypass with publicly available exploit code, allowing unauthenticated attackers to…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-53108?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53108. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-53108?

Within 24 hours, conduct a complete inventory of WordPress installations using User Registration & Membership plugin and identify those running versions prior to 5.2.6. Within 7 days, upgrade all affected instances to version 5.2.6 or later, coordinating updates during low-traffic periods and performing functional testing to confirm registration controls enforce correctly post-update. Within 30 days, complete a comprehensive audit of account creation logs from the period prior to patching to identify any unauthorized accounts created during the exposure window, implement continuous monitoring of registration events, and verify that the registration-disabled setting now functions as intended.

User Registration & Membership EUVD-2026-53108

| CVE-2026-16736 HIGH

Improper Access Control (CWE-284)

2026-08-05 WPScan

GHSA-r7cf-cqmf-q6pj

WordPress Authentication Bypass User Registration Membership Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Unauthenticated network access with no complexity; C:L and I:L reflect member-content exposure and unauthorized account writes, not full system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:48 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.

AnalysisAI

Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allows unauthenticated users to create accounts on sites where the administrator has explicitly disabled open registration. The plugin processes registration form submissions without validating the site-level registration-disabled setting, effectively nullifying an administrative security control. A publicly available exploit exists per WPScan, though EPSS sits at a low 0.15% (4th percentile), indicating limited observed exploitation despite the accessible POC.

Technical ContextAI

The vulnerability is rooted in CWE-284 (Improper Access Control) - a failure to enforce an authorization boundary at a critical decision point. The User Registration & Membership plugin for WordPress adds its own registration form and submission handler, but that handler does not consult WordPress's native or plugin-level registration-enabled flag before proceeding. As a result, the server-side gate that should reject registrations on closed sites is absent. The affected CPE (cpe:2.3:a:unknown:user_registration_&_membership:*:*:*:*:*:*:*:*) covers all plugin versions prior to 5.2.6. This is a logic flaw rather than a memory-safety or injection issue - the correct data exists in the configuration, but the code path simply never checks it.

RemediationAI

Upgrade the User Registration & Membership plugin to version 5.2.6 or later - this is the vendor-released patch confirmed to address the bypass. Administrators can apply the update directly from the WordPress admin dashboard under Plugins > Updates. If immediate upgrade is not feasible, a compensating control is to remove or deactivate the plugin entirely until patching is possible, which eliminates the attack surface at the cost of losing plugin functionality. Alternatively, administrators can add server-level rate limiting or WAF rules to block POST requests to the plugin's registration endpoint (typically /wp-admin/admin-ajax.php or the plugin's custom endpoint), though this may also block legitimate future use. Do not rely on WordPress core's registration-disabled setting alone as a control - this CVE confirms it is not enforced by the plugin.