CVE-2026-16736
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.
Risk Assessment
The risk is that unauthorized users can create accounts in the system, potentially leading to uncontrolled access and abuse.
Recommendation
It is recommended to update the User Registration & Membership plugin to version 5.2.6 or higher to enforce registration settings.
Other vulnerabilities in User Registration & Membership WordPress plugin
See all- CVE-2026-79996High
The User Registration & Membership WordPress plugin before version 5.2.6 does not perform a capability check when saving its login settings. Authenticated users with plugin management capability but without full administrator access can change arbitrary site options and escalate their privileges to administrator.
- CVE-2026-79995Medium
The User Registration & Membership WordPress plugin before version 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request. Authenticated users with Subscriber-level access and above can cancel any other user's in-progress email change, including an administrator's.
Original NVD description (English source)
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.