User Registration Membership
Monthly
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any authenticated Subscriber-level user to cancel a pending email change belonging to any other account - including site administrators. The flaw stems from the plugin's email-change cancellation handler accepting a user identifier supplied by the requester without verifying account ownership, a classic IDOR pattern. A publicly available exploit exists per WPScan; however, SSVC assessment lists exploitation as none and the attack is not automatable, indicating opportunistic rather than widespread active abuse.
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allows unauthenticated users to create accounts on sites where the administrator has explicitly disabled open registration. The plugin processes registration form submissions without validating the site-level registration-disabled setting, effectively nullifying an administrative security control. A publicly available exploit exists per WPScan, though EPSS sits at a low 0.15% (4th percentile), indicating limited observed exploitation despite the accessible POC.
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) exposes a membership payment action endpoint that performs no capability check on the caller, allowing any unauthenticated remote attacker to supply an arbitrary user identifier and delete recently-registered, payment-pending accounts. The flaw is a classic CWE-639 Insecure Direct Object Reference - the plugin trusts a caller-supplied user ID without verifying the caller has authority to act on it. A publicly available proof-of-concept exists, and SSVC classifies exploitation as automatable, though the EPSS score of 0.14% (3rd percentile) indicates limited observed exploitation volume at the time of analysis.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors self-assign an arbitrary published membership tier during public registration, gaining that tier's user role - including administrator where such a tier exists. The plugin never validates that the tier submitted in the registration form is one the form actually offers, so an attacker simply tampers with the submitted tier value. Publicly available exploit code exists (reported by WPScan), though active exploitation has not been confirmed.
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated attackers forge a payment-provider webhook to mark a subscription as paid, activating premium memberships without any real transaction. WPScan reports publicly available exploit code, though there is no public exploit identified as being used in active attacks (not in CISA KEV). The core weakness is that inbound webhook notifications are trusted and acted upon without authenticating their origin or signature.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-privileged user (e.g. a subscriber) alter another account's WordPress role and membership tier. The membership-upgrade action performs no authorization check and trusts a caller-supplied user identifier instead of the current session, so an attacker can target an arbitrary account - including their own - to gain higher roles up to administrator. Publicly available exploit code exists and a vendor patch is available, but this is not listed in CISA KEV.
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their account role when the Membership Addon is enabled. This allows unauthenticated users to register with administrator privileges, bypassing all intended access controls.
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Deserialization of Untrusted Data vulnerability in WPEverest User Registration.3.2.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The User Registration - Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any authenticated Subscriber-level user to cancel a pending email change belonging to any other account - including site administrators. The flaw stems from the plugin's email-change cancellation handler accepting a user identifier supplied by the requester without verifying account ownership, a classic IDOR pattern. A publicly available exploit exists per WPScan; however, SSVC assessment lists exploitation as none and the attack is not automatable, indicating opportunistic rather than widespread active abuse.
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allows unauthenticated users to create accounts on sites where the administrator has explicitly disabled open registration. The plugin processes registration form submissions without validating the site-level registration-disabled setting, effectively nullifying an administrative security control. A publicly available exploit exists per WPScan, though EPSS sits at a low 0.15% (4th percentile), indicating limited observed exploitation despite the accessible POC.
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) exposes a membership payment action endpoint that performs no capability check on the caller, allowing any unauthenticated remote attacker to supply an arbitrary user identifier and delete recently-registered, payment-pending accounts. The flaw is a classic CWE-639 Insecure Direct Object Reference - the plugin trusts a caller-supplied user ID without verifying the caller has authority to act on it. A publicly available proof-of-concept exists, and SSVC classifies exploitation as automatable, though the EPSS score of 0.14% (3rd percentile) indicates limited observed exploitation volume at the time of analysis.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors self-assign an arbitrary published membership tier during public registration, gaining that tier's user role - including administrator where such a tier exists. The plugin never validates that the tier submitted in the registration form is one the form actually offers, so an attacker simply tampers with the submitted tier value. Publicly available exploit code exists (reported by WPScan), though active exploitation has not been confirmed.
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated attackers forge a payment-provider webhook to mark a subscription as paid, activating premium memberships without any real transaction. WPScan reports publicly available exploit code, though there is no public exploit identified as being used in active attacks (not in CISA KEV). The core weakness is that inbound webhook notifications are trusted and acted upon without authenticating their origin or signature.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-privileged user (e.g. a subscriber) alter another account's WordPress role and membership tier. The membership-upgrade action performs no authorization check and trusts a caller-supplied user identifier instead of the current session, so an attacker can target an arbitrary account - including their own - to gain higher roles up to administrator. Publicly available exploit code exists and a vendor patch is available, but this is not listed in CISA KEV.
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their account role when the Membership Addon is enabled. This allows unauthenticated users to register with administrator privileges, bypassing all intended access controls.
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Deserialization of Untrusted Data vulnerability in WPEverest User Registration.3.2.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The User Registration - Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.