3.7
Faible
CVE-2026-86407 The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its…
Description
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| User Registration & Membership 5.0 | 5.0 → < 5.2.8 | 5.2.8 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de User Registration & Membership
Les 14 CVE de User Registration & Membership →
CVE-2026-86406
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a…
7.5
Élevée
CVE-2026-80072
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login…
4.7
Moyenne
CVE-2026-80071
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership…
7.2
Élevée
CVE-2026-79995
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email…
4.3
Moyenne