These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration. This issue affects WordPress sites using the User Registration & Membership plugin. The plugin's registration form submiss [truncated]
The CVE record for CVE-2026-11966 was published on 2026-07-17T07:16:37.947Z and has not been modified since then. The vulnerability is related to the User Registration & Membership WordPress plugin before version 5.2.3. The plugin has a vulnerability that allows unauthenticated attackers to delete recently-registered, payment-pending user accounts. This vulnerability is a result of the plugin not performi [truncated]
The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role. This allows unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exists. Th [truncated]
The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment. This vulnerability has a high impact on users with active paid membership subscriptions, [truncated]
The User Registration & Membership WordPress plugin before 5.2.2 has a vulnerability that allows any authenticated user, including subscribers, to change another user's WordPress role and membership tier. This is due to a lack of authorization checks on membership-upgrade actions. The vulnerability has a high impact on users with subscriber or lower-level access. The CVE record was published on 2026-07-13 [truncated]
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to SQL Injection via the ‘membership_ids[]’ parameter in all versions up to, and including, 5.1.2. This vulnerability allows authenticated attackers, with Subscriber-level access and above, to append additional SQL queri [truncated]
