User Registration Membership

WordPress plugin · user-registration-membership · WordPress.org ↗

Critical

High

Known total

Unfixed

Running User Registration Membership on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
CRITICAL CVSS 9.1	User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation CVE.org	>=0, <5.2.2	v5.2.2	CVE-2026-11964	Jul 13, 2026
HIGH CVSS 7.5	User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase CVE.org	>=4.4.6, <5.2.8	v5.2.8	CVE-2026-86406	Sep 13, 2026
HIGH CVSS 7.2	User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator CVE.org	>=0, <5.2.8	v5.2.8	CVE-2026-80071	Sep 13, 2026
HIGH CVSS 7.2	User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings CVE.org	>=0, <5.2.6	v5.2.6	CVE-2026-79996	Aug 28, 2026
HIGH CVSS 7.5	User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled CVE.org	>=0, <5.2.6	v5.2.6	CVE-2026-16736	Aug 5, 2026
HIGH CVSS 8.1	User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID CVE.org	>=0, <5.2.3	v5.2.3	CVE-2026-11961	Jul 17, 2026
HIGH CVSS 8.1	User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR CVE.org	>=0, <5.2.2	v5.2.2	CVE-2026-11963	Jul 13, 2026
MEDIUM CVSS 4.7	User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters CVE.org	>=0, <5.2.8	v5.2.8	CVE-2026-80072	Sep 13, 2026
MEDIUM CVSS 4.3	User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR CVE.org	>=0, <5.2.5	v5.2.5	CVE-2026-79995	Aug 28, 2026
MEDIUM CVSS 5.3	User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler CVE.org	>=4.2.3, <5.2.3	v5.2.3	CVE-2026-11966	Jul 17, 2026
MEDIUM CVSS 6.5	User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership Bypass CVE.org	>=0, <5.2.0	v5.2.0	CVE-2026-11965	Jul 2, 2026
LOW CVSS 3.7	User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page CVE.org	>=5.0, <5.2.8	v5.2.8	CVE-2026-86407	Sep 13, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.