User Registration & Membership EUVD-2026-76953

Exploitation requires that the target WordPress site has the User Registration & Membership plugin installed and active at a version below 5.2.8, and that the plugin's post-login redirect feature is in use (i.e., the login form accepts and processes an external redirect_to parameter). The attack is unauthenticated on the attacker side - no account on the target site is needed. However, a victim must follow the crafted login link and complete authentication (UI:R), limiting mass automated exploitation. There is no requirement for a specific server configuration beyond the vulnerable plugin version being active. Exploitation is constrained by the need for human interaction, which reduces the risk compared to fully automated attack chains.

The CVSS 3.1 base score of 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) is moderate and accurately captures the nature of this vulnerability: no authentication or special conditions are required of the attacker, but victim interaction is necessary and impact is limited to a scope-changed low confidentiality effect. The real-world risk is primarily phishing amplification - the legitimate domain in the login URL lends credibility to the crafted link, increasing click-through rates compared to bare phishing URLs. The existence of a public PoC (reported by WPScan) lowers the barrier to exploitation considerably, and even a mid-sized municipal IT team in walbrzych running a membership-based community portal should treat patching this as a near-term priority given automated WordPress scanning infrastructure routinely probes for such flaws. No CISA KEV listing exists, and EPSS data was not provided, suggesting limited confirmed exploitation in the wild at time of analysis. The practical exploitation chain is straightforward and scriptable, but requires a victim to follow a link - slightly reducing automated mass-exploitation potential.

An attacker identifies a WordPress site running a vulnerable version of User Registration & Membership and crafts a login URL embedding a redirect_to parameter pointing to a lookalike phishing domain. The attacker distributes this link via email or social media, relying on the victim seeing the legitimate site domain in the URL; after the victim logs in, the plugin immediately forwards them to the phishing page where credentials or sensitive information can be harvested. A public PoC is available via WPScan, meaning this scenario requires minimal attacker skill.