Unauthenticated Subscription Activation in User Registration & Membership WordPress Plugin

Executive Summary

The vulnerability CVE-2026-11965 affects the WordPress plugin "User Registration & Membership" versions prior to 5.2.0. It allows unauthenticated users to bypass payment for paid membership subscriptions by exploiting a flaw in the plugin's registration and membership activation process.

An attacker can create an account through the open self-registration flow, then manipulate the system to activate a paid membership without completing payment. This is done by exploiting nonces and session-bound tokens to plant an active subscription for any paid plan, granting access to gated content.

This vulnerability is classified as an authentication bypass (CWE-287) with a medium severity CVSS score of 6.5.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated users to obtain active paid membership subscriptions without paying. As a result, unauthorized users can access gated or premium content that should be restricted to paying members only.

This can lead to revenue loss for website owners who rely on paid memberships, as well as potential exposure of exclusive content to unauthorized users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the User Registration & Membership WordPress plugin to version 5.2.0 or later, where the issue has been fixed.

Additionally, consider temporarily disabling open self-registration if possible, to prevent unauthenticated users from creating accounts and exploiting the payment bypass.

Useful 0 Not Useful 0