User Registration Membership
Monthly
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allows unauthenticated users to create accounts on sites where the administrator has explicitly disabled open registration. The plugin processes registration form submissions without validating the site-level registration-disabled setting, effectively nullifying an administrative security control. A publicly available exploit exists per WPScan, though EPSS sits at a low 0.15% (4th percentile), indicating limited observed exploitation despite the accessible POC.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors self-assign an arbitrary published membership tier during public registration, gaining that tier's user role - including administrator where such a tier exists. The plugin never validates that the tier submitted in the registration form is one the form actually offers, so an attacker simply tampers with the submitted tier value. Publicly available exploit code exists (reported by WPScan), though active exploitation has not been confirmed.
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated attackers forge a payment-provider webhook to mark a subscription as paid, activating premium memberships without any real transaction. WPScan reports publicly available exploit code, though there is no public exploit identified as being used in active attacks (not in CISA KEV). The core weakness is that inbound webhook notifications are trusted and acted upon without authenticating their origin or signature.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-privileged user (e.g. a subscriber) alter another account's WordPress role and membership tier. The membership-upgrade action performs no authorization check and trusts a caller-supplied user identifier instead of the current session, so an attacker can target an arbitrary account - including their own - to gain higher roles up to administrator. Publicly available exploit code exists and a vendor patch is available, but this is not listed in CISA KEV.
The User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their account role when the Membership Addon is enabled. This allows unauthenticated users to register with administrator privileges, bypassing all intended access controls.
Unauthenticated information disclosure in the User Registration & Membership WordPress plugin (versions 5.0 through 5.2.7) exposes arbitrary users' email addresses, profile fields, roles, and membership order details to any visitor. The plugin's membership confirmation page performs no ownership verification - an attacker who supplies another user's identifier in the request receives that user's data if the site operator has configured user smart tags on the page's message template. No public exploit confirmed in CISA KEV, though a publicly available proof-of-concept is documented by WPScan.
Open redirect in the User Registration & Membership WordPress plugin before 5.2.8 permits unauthenticated attackers to craft post-login redirect URLs pointing to arbitrary external domains, enabling phishing campaigns targeting site visitors. The plugin fails to validate the destination parameter before executing the redirect, meaning any visitor who follows a specially crafted login link is silently forwarded to an attacker-controlled page after authenticating. A publicly available proof-of-concept exists per WPScan, and a vendor patch was released in version 5.2.8.
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any authenticated Subscriber-level user to cancel a pending email change belonging to any other account - including site administrators. The flaw stems from the plugin's email-change cancellation handler accepting a user identifier supplied by the requester without verifying account ownership, a classic IDOR pattern. A publicly available exploit exists per WPScan; however, SSVC assessment lists exploitation as none and the attack is not automatable, indicating opportunistic rather than widespread active abuse.
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) exposes a membership payment action endpoint that performs no capability check on the caller, allowing any unauthenticated remote attacker to supply an arbitrary user identifier and delete recently-registered, payment-pending accounts. The flaw is a classic CWE-639 Insecure Direct Object Reference - the plugin trusts a caller-supplied user ID without verifying the caller has authority to act on it. A publicly available proof-of-concept exists, and SSVC classifies exploitation as automatable, though the EPSS score of 0.14% (3rd percentile) indicates limited observed exploitation volume at the time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration allows Reflected XSS. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration allows Stored XSS.0.3. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in WPEverest User Registration.3.2.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The User Registration - Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allows unauthenticated users to create accounts on sites where the administrator has explicitly disabled open registration. The plugin processes registration form submissions without validating the site-level registration-disabled setting, effectively nullifying an administrative security control. A publicly available exploit exists per WPScan, though EPSS sits at a low 0.15% (4th percentile), indicating limited observed exploitation despite the accessible POC.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors self-assign an arbitrary published membership tier during public registration, gaining that tier's user role - including administrator where such a tier exists. The plugin never validates that the tier submitted in the registration form is one the form actually offers, so an attacker simply tampers with the submitted tier value. Publicly available exploit code exists (reported by WPScan), though active exploitation has not been confirmed.
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated attackers forge a payment-provider webhook to mark a subscription as paid, activating premium memberships without any real transaction. WPScan reports publicly available exploit code, though there is no public exploit identified as being used in active attacks (not in CISA KEV). The core weakness is that inbound webhook notifications are trusted and acted upon without authenticating their origin or signature.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-privileged user (e.g. a subscriber) alter another account's WordPress role and membership tier. The membership-upgrade action performs no authorization check and trusts a caller-supplied user identifier instead of the current session, so an attacker can target an arbitrary account - including their own - to gain higher roles up to administrator. Publicly available exploit code exists and a vendor patch is available, but this is not listed in CISA KEV.
The User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their account role when the Membership Addon is enabled. This allows unauthenticated users to register with administrator privileges, bypassing all intended access controls.
Unauthenticated information disclosure in the User Registration & Membership WordPress plugin (versions 5.0 through 5.2.7) exposes arbitrary users' email addresses, profile fields, roles, and membership order details to any visitor. The plugin's membership confirmation page performs no ownership verification - an attacker who supplies another user's identifier in the request receives that user's data if the site operator has configured user smart tags on the page's message template. No public exploit confirmed in CISA KEV, though a publicly available proof-of-concept is documented by WPScan.
Open redirect in the User Registration & Membership WordPress plugin before 5.2.8 permits unauthenticated attackers to craft post-login redirect URLs pointing to arbitrary external domains, enabling phishing campaigns targeting site visitors. The plugin fails to validate the destination parameter before executing the redirect, meaning any visitor who follows a specially crafted login link is silently forwarded to an attacker-controlled page after authenticating. A publicly available proof-of-concept exists per WPScan, and a vendor patch was released in version 5.2.8.
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any authenticated Subscriber-level user to cancel a pending email change belonging to any other account - including site administrators. The flaw stems from the plugin's email-change cancellation handler accepting a user identifier supplied by the requester without verifying account ownership, a classic IDOR pattern. A publicly available exploit exists per WPScan; however, SSVC assessment lists exploitation as none and the attack is not automatable, indicating opportunistic rather than widespread active abuse.
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) exposes a membership payment action endpoint that performs no capability check on the caller, allowing any unauthenticated remote attacker to supply an arbitrary user identifier and delete recently-registered, payment-pending accounts. The flaw is a classic CWE-639 Insecure Direct Object Reference - the plugin trusts a caller-supplied user ID without verifying the caller has authority to act on it. A publicly available proof-of-concept exists, and SSVC classifies exploitation as automatable, though the EPSS score of 0.14% (3rd percentile) indicates limited observed exploitation volume at the time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration allows Reflected XSS. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration allows Stored XSS.0.3. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in WPEverest User Registration.3.2.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The User Registration - Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.