User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Unauthenticated Payment Bypass via PayPal Order Completion
- ID
- WPSEC-2026-2710
- Plugin
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (user-registration)
- Affected
- all versions before 5.3.2
- Remediation
- Update to 5.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-07
- Attack surface
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder on WPSec AttackSurface
- Fix released
- Published
Description
The User Registration & Membership plugin for WordPress is vulnerable to payment verification bypass via the PayPal (REST) checkout webhook in all versions up to, and including, 5.3.1. This is due to the webhook handler completing the member's latest order and activating the subscription on a CHECKOUT.ORDER.APPROVED event, which PayPal sends before any payment is captured, without checking the captured amount or currency. The redirect and webhook handlers also matched the member's most recent order instead of the order the checkout was created for. This makes it possible for unauthenticated attackers who register through a paid membership form to have the membership activated without paying, by approving the PayPal order and never returning to the site.
References
- https://wpsec.com/vuln/WPSEC-2026-2710/
- https://plugins.svn.wordpress.org/user-registration/tags/5.3.2/
- https://wordpress.org/plugins/user-registration/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS