EUVD-2026-63314
GHSA-89qm-92rc-c56h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote broken-auth account takeover (AV:N/AC:L/PR:N/UI:N); seizing a privileged account yields full C/I/A, hence H/H/H with unchanged scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
AnalysisAI
Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the User Registration & Membership Pro plugin (version 5.4.5 or earlier) to be installed and active on a reachable WordPress site with its registration/login/membership functionality exposed to attackers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are strongly aligned toward high priority for exposed WordPress sites running this plugin: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates fully remote, low-complexity, unauthenticated exploitation, and the H/H/H impact reflects that taking over a privileged account yields full site compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the WordPress site sends a crafted request to the plugin's vulnerable registration or authentication endpoint, exploiting the broken authentication check to bind their session to a targeted account rather than a legitimately verified one. With no credentials, privileges, or user interaction required, they log in as that user - and if an administrator account is reachable, they obtain full control of the site. … |
| Remediation | No exact fixed version is stated in the provided data; since 5.4.5 and earlier are affected, upgrade to the next vendor-released version above 5.4.5 as published by WPEverest/Patchstack - patched version not independently confirmed here, so confirm the target release in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/user-registration-pro/vulnerability/wordpress-user-registration-membership-pro-plugin-5-4-5-account-takeover-vulnerability) before applying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances running WPEverest User Registration & Membership Pro versions 5.4.5 and earlier; disable the plugin or restrict public access to registration endpoints; audit all user accounts for unauthorized modifications and privilege escalation to admin status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today