3.7
Low
CVE-2026-86407 The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its…
Description
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| User Registration & Membership 5.0 | 5.0 → < 5.2.8 | 5.2.8 |
Other CVEs of User Registration & Membership
The 14 CVEs of User Registration & Membership →
CVE-2026-86406
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a…
7.5
High
CVE-2026-80072
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login…
4.7
Medium
CVE-2026-80071
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership…
7.2
High
CVE-2026-79995
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email…
4.3
Medium