Vulnerabilities / User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder / WPSEC-2026-2713
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Unauthenticated Authentication Bypass via Auto Login
Medium 4.8
CWE-287Fixed in 5.3.2
- ID
- WPSEC-2026-2713
- Plugin
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (user-registration)
- Affected
- all versions before 5.3.2
- Remediation
- Update to 5.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-287
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-07
- Attack surface
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder on WPSec AttackSurface
- Fix released
- Published
Description
The User Registration & Membership plugin for WordPress is vulnerable to Authentication Bypass via the membership payment confirmation auto login feature in all versions up to, and including, 5.3.1. This is due to the plugin deciding whether to log a member in from an 'auto_login' flag in the client-supplied form response, and not checking whether the member is still awaiting admin approval or has been disabled. This makes it possible for unauthenticated attackers who register an account to be logged in without the required admin approval when manual approval is enabled on the site.
References
- https://wpsec.com/vuln/WPSEC-2026-2713/
- https://plugins.svn.wordpress.org/user-registration/tags/5.3.2/
- https://wordpress.org/plugins/user-registration/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS