CVE-2026-92978 wpeverest CVE debrief

Who should care

WordPress site administrators, security teams, and users of the User Registration & Membership plugin should assess exposure and apply patches to prevent potential attacks. Affected operators and platforms must review and verify the authenticity of requests to prevent unauthorized actions. Vulnerability management and security teams should prioritize patching and monitoring to mitigate the risk of exploitation.

Why it matters

CVE-2026-92978 is a Cross-Site Request Forgery vulnerability in the User Registration & Membership plugin for WordPress. It allows attackers to manipulate administrative actions, potentially affecting user registrations and account management. WordPress administrators and security teams should assess exposure and apply patches.

• Potential unauthorized user registration or account denial.
• Possible locking of legitimate users out of the site.
• Increased risk of administrative actions being manipulated by attackers.
• Verification of plugin version and patch application required.

Technical summary

The User Registration & Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the trigger_bulk_action function. This allows unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, potentially locking users out of the site. The vulnerability can be exploited by supplying an empty new_role parameter, which causes the earlier nonce check to return early and cede control to the unprotected trigger_bulk_action handler.

Defensive priority

Medium priority for WordPress administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the User Registration & Membership plugin version is 5.2.8 or earlier.
• Apply patches or updates to the plugin to fix the vulnerability.
• Monitor for suspicious requests to the WordPress site's user registration and management pages.
• Educate administrators on the importance of verifying request authenticity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD. Details are provided by Wordfence security researchers. However, the corpus does not provide information on exploitation or affected sites. To verify, defenders should check the plugin version and review user registration and management pages for suspicious requests. The CVE Program and NVD provide official records, while Wordfence offers additional insights into the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.