CVE-2026-74001
Deferred Deferred - Pending Action

Unauthenticated Broken Authentication in User Registration & Membership Pro

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Patchstack

Description
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-74001
EUVD
EUVD-2026-63314

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
patchstack user_registration_pro to 5.4.5 (inc)
patchstack user_registration_and_membership_pro to 5.4.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74001 is an unauthenticated broken authentication vulnerability in the User Registration & Membership Pro WordPress plugin versions 5.4.5 and below. It allows attackers to perform privileged actions without authentication, potentially gaining administrative access to affected websites.

Detection Guidance

Check if the User Registration & Membership Pro plugin is installed and its version is 5.4.5 or below. Look for unauthorized admin account creations or privilege escalations in logs. Use network monitoring for suspicious requests targeting user registration endpoints.

Impact Analysis

This vulnerability can lead to complete website compromise, including unauthorized admin access, data theft, or site defacement. Attackers could exploit it remotely without any user interaction, making it highly dangerous for unpatched sites.

Compliance Impact

A successful exploit could result in unauthorized access to sensitive user data, violating GDPR and HIPAA requirements for data protection and access control. This may lead to legal penalties, fines, and reputational damage for affected organizations.

Mitigation Strategies

Update the User Registration & Membership Pro plugin to version 5.4.6 or later immediately. Apply Patchstack's temporary mitigation rule if an update is not immediately possible. Review all admin accounts for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74001. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart