CVE-2026-96660

The User Registration & Membership WordPress plugin before version 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them. This allows unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.

The User Registration & Membership plugin for WordPress in versions up to and including 5.2.8 is vulnerable to Arbitrary Shortcode Execution due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(). The attacker-controlled HTTP_REFERER header passes only through sanitize_text_field(), which does not strip WordPress shortcode delimiters, before being substituted into a Content Restriction message executed via apply_shortcodes()/do_shortcode().

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting. This allows unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.

The User Registration & Membership WordPress plugin before version 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.

The User Registration & Membership WordPress plugin before version 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form. This allows unauthenticated users to register into an arbitrary published membership tier and obtain its associated role, including administrator if such a tier exists.

The User Registration & Membership WordPress plugin before version 5.2.2 lacks authorization checks on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user. This allows any authenticated user, such as a subscriber, to change another user's WordPress role and membership tier.

The User Registration & Membership WordPress plugin before version 5.2.0 does not enforce payment completion before activating a paid membership subscription. This allows unauthenticated users (after self-registering an account through the open registration flow) to obtain an active subscription on any paid plan without paying and access the gated content.

The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 'membership_ids[]' parameter in all versions up to and including 5.1.2. Insufficient escaping and preparation on the SQL query allows authenticated attackers (Subscriber-level and above) to append additional SQL queries.

The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress (all versions up to and including 4.4.6) is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes due to insufficient input sanitization and output escaping. An authenticated attacker with contributor level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.