Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: User Registration & Membership 5.2.8 Clear all filters
TI-2026-59122 CVE-2026-86407 · GHSA-wr2r-r9vc-rr7g

User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page

Priority LOW 17

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase h…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.0028 Published 2026-09-13 Fixed in 5.2.8 CWE-200
TI-2026-59121 CVE-2026-86406 · GHSA-23fc-j83w-rxq7

User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase

Priority LOW 35

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing an…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00323 Published 2026-09-13 Fixed in 5.2.8 CWE-269
TI-2026-55341 CVE-2026-80072 · GHSA-w78c-fx7q-9x8m

User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters

Priority LOW 21

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary exte…

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.0029 Published 2026-09-13 Fixed in 5.2.8 CWE-601
TI-2026-55340 CVE-2026-80071 · GHSA-7cc7-ppv7-mjwp

User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator

Priority LOW 34

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Au…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00462 Published 2026-09-13 Fixed in 5.2.8 CWE-269