CVE-2026-1869CWE-862

User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass

Medium · published June 26, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm_payment() function in all versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to bypass payment processing and activate paid memberships.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-26T07:54Z
EPSS history
Timeline
  • 26 JUN 07:54Z
    User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass
    cvelistv5