User Registration & Membership
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:user_registration_&_membership:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | User Registration & Membership (5f14c48c-e239-5c55-9834-dc49216ec26b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-86407 |
vulnerable | 2026-09-16 04:32:58.950705 |
User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.
Published: 2026-09-13T06:00:08.517Z
Updated: 2026-09-13T10:45:08.152Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86406 |
vulnerable | 2026-09-16 04:32:58.763916 |
User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.
Published: 2026-09-13T06:00:08.312Z
Updated: 2026-09-13T10:45:23.160Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16736 |
vulnerable | 2026-09-16 04:32:56.473713 |
User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.
Published: 2026-08-05T06:00:10.288Z
Updated: 2026-08-05T15:18:10.214Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-80072 |
vulnerable | 2026-09-16 04:32:40.073853 |
User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.
Published: 2026-09-13T06:00:08.138Z
Updated: 2026-09-13T10:45:38.326Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-80071 |
vulnerable | 2026-09-16 04:32:39.901709 |
User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.
Published: 2026-09-13T06:00:07.965Z
Updated: 2026-09-13T10:45:53.169Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11966 |
vulnerable | 2026-07-29 00:23:31.836202 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11965 |
vulnerable | 2026-07-29 00:23:31.836081 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11964 |
vulnerable | 2026-07-29 00:23:31.835946 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11963 |
vulnerable | 2026-07-29 00:23:31.835829 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11961 |
vulnerable | 2026-07-29 00:23:31.834251 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2594 |
vulnerable | 2026-06-08 07:16:57.623928 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2563 |
vulnerable | 2026-06-08 07:16:57.449781 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.