Unauthenticated Subscription Activation in User Registration & Membership WordPress Plugin

Executive Summary

The vulnerability CVE-2026-11965 affects the WordPress plugin "User Registration & Membership" versions prior to 5.2.0. It allows unauthenticated users to bypass payment for paid membership subscriptions by exploiting a flaw in the plugin's registration and membership activation process.

An attacker can create an account through the open self-registration flow, then manipulate the system to activate a paid membership without completing payment. This is done by exploiting nonces and session-bound tokens to plant an active subscription for any paid plan, granting access to gated content.

This vulnerability is classified as an authentication bypass (CWE-287) with a medium severity CVSS score of 6.5.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your system, you should first verify if the WordPress plugin "User Registration & Membership" is installed and if its version is prior to 5.2.0, as versions before 5.2.0 are vulnerable.

Since the vulnerability allows unauthenticated users to activate paid memberships without payment by exploiting the registration and membership activation process, monitoring for suspicious account creations followed by immediate access to paid content without payment can be an indicator.

There are no specific commands provided in the available resources to detect exploitation attempts directly. However, you can use the following general approaches:

• Check the plugin version via WP-CLI: `wp plugin get user-registration-and-membership --field=version`
• Review user registrations and membership activations in the WordPress admin dashboard or database to identify accounts with active paid subscriptions but no corresponding payment records.
• Monitor web server logs for unusual POST requests to registration or membership activation endpoints that might indicate exploitation attempts.
• Use WordPress security plugins or monitoring tools to alert on new user registrations and subscription activations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated users to obtain active paid membership subscriptions without paying. As a result, unauthorized users can access gated or premium content that should be restricted to paying members only.

This can lead to revenue loss for website owners who rely on paid memberships, as well as potential exposure of exclusive content to unauthorized users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the User Registration & Membership WordPress plugin to version 5.2.0 or later, where the issue has been fixed.

Additionally, consider temporarily disabling open self-registration if possible, to prevent unauthenticated users from creating accounts and exploiting the payment bypass.

Useful 0 Not Useful 0