CVE-2026-80072
MediumCVSS 4.7Summary
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting. This allows unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.
Risk Assessment
Attackers can exploit the vulnerability to conduct phishing attacks by impersonating a trusted site. This may lead to credential theft and compromise of user security.
Recommendation
Update the User Registration & Membership plugin to version 5.2.8 or later. Inform users about phishing risks and encourage them to verify URLs.
Other vulnerabilities in User Registration & Membership
See all- CVE-2026-11964Critical
The User Registration & Membership WordPress plugin before version 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them. This allows unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
- CVE-2026-11966Medium
The User Registration & Membership WordPress plugin before version 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.
- CVE-2026-11961High
The User Registration & Membership WordPress plugin before version 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form. This allows unauthenticated users to register into an arbitrary published membership tier and obtain its associated role, including administrator if such a tier exists.
- CVE-2026-11963High
The User Registration & Membership WordPress plugin before version 5.2.2 lacks authorization checks on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user. This allows any authenticated user, such as a subscriber, to change another user's WordPress role and membership tier.
- CVE-2026-11965Medium
The User Registration & Membership WordPress plugin before version 5.2.0 does not enforce payment completion before activating a paid membership subscription. This allows unauthenticated users (after self-registering an account through the open registration flow) to obtain an active subscription on any paid plan without paying and access the gated content.
- CVE-2026-1865Medium
The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 'membership_ids[]' parameter in all versions up to and including 5.1.2. Insufficient escaping and preparation on the SQL query allows authenticated attackers (Subscriber-level and above) to append additional SQL queries.
Original NVD description (English source)
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.