CVE-2026-1865

The User Registration & Membership WordPress plugin before version 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them. This allows unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting. This allows unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.

The User Registration & Membership WordPress plugin before version 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.

The User Registration & Membership WordPress plugin before version 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form. This allows unauthenticated users to register into an arbitrary published membership tier and obtain its associated role, including administrator if such a tier exists.

The User Registration & Membership WordPress plugin before version 5.2.2 lacks authorization checks on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user. This allows any authenticated user, such as a subscriber, to change another user's WordPress role and membership tier.

The User Registration & Membership WordPress plugin before version 5.2.0 does not enforce payment completion before activating a paid membership subscription. This allows unauthenticated users (after self-registering an account through the open registration flow) to obtain an active subscription on any paid plan without paying and access the gated content.