CVE-2026-11964
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The User Registration & Membership WordPress plugin before version 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them. This allows unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
Risk Assessment
The organization is at risk of unauthorized activation of paid subscriptions, leading to financial losses and compromise of the membership management system's integrity.
Recommendation
Immediately update the User Registration & Membership plugin to version 5.2.2 or later, which includes a fix to verify the authenticity of webhook notifications.
Original NVD description (English source)
The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.