User Registration & Membership EUVD-2026-76955

Exploitation requires two concurrent conditions: (1) the target site must be running User Registration & Membership plugin version 5.0 through 5.2.7, AND (2) the site administrator must have explicitly added one or more 'user smart tag' placeholders to the membership confirmation page's configurable message - a non-default configuration that is NOT present in the plugin's shipped defaults. Without smart tags on that page, the IDOR exists structurally but no sensitive user data is rendered or returned. The attacker also needs knowledge of a valid target username or user ID, which can be enumerated through standard WordPress discovery techniques (REST API, author archives). No authentication is required by the attacker; no user interaction from the victim is needed. Exploitation is limited to information disclosure only - no integrity or availability impact is possible through this vector.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N = 3.7) is well-calibrated for this vulnerability. The AC:H metric is justified by the non-default exploitation prerequisite: smart tags must be explicitly placed on the confirmation page by a site administrator, which the plugin does not do in its shipped default configuration. Without smart tags, the page discloses no sensitive fields regardless of the IDOR. The confidentiality impact is low-to-moderate - email and profile fields are recoverable, but credentials and payment instruments are not described as exposed. EPSS data was not provided, but the low CVSS score and high attack complexity condition the real-world risk significantly. A publicly available WPScan proof-of-concept raises discoverability, but the gate condition (smart tags configured) substantially limits the realistic exposed population. This is not a high-priority emergency for most sites, but sites using smart tags on confirmation pages with sensitive profile fields face meaningful user privacy risk.

An attacker enumerates a target WordPress site's usernames (via the WordPress REST API or login error messages), then crafts a GET request to the membership confirmation page appending the victim's username or user ID as a query parameter. If the site admin has added user smart tags (e.g., email address or custom profile fields) to that page's template, the server renders and returns the victim's personal data without verifying the requester has any relationship to that account. A publicly available proof-of-concept from WPScan confirms the technique is documented and reproducible.