Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
1 selected

2 records

Release: User Registration & Membership 5.2.2 Clear all filters
TI-2026-10309 CVE-2026-11964 · GHSA-6f2x-47pc-8mpq

User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature…

Priority HIGH 80

The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a pa…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00454 Published 2026-07-13 Fixed in 5.2.2
TI-2026-10308 CVE-2026-11963 · GHSA-qxg2-gwhj-546g

User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR

Priority HIGH 70

The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the curr…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0035 Published 2026-07-13 Fixed in 5.2.2