# User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Unauthenticated Authentication Bypass via Auto Login

- **ID:** WPSEC-2026-2713
- **Plugin:** User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (`user-registration`), https://wordpress.org/plugins/user-registration/
- **Affected versions:** all versions before 5.3.2
- **Fixed in:** 5.3.2 (Update to 5.3.2 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/user-registration
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2713/

## Description

The User Registration & Membership plugin for WordPress is vulnerable to Authentication Bypass via the membership payment confirmation auto login feature in all versions up to, and including, 5.3.1. This is due to the plugin deciding whether to log a member in from an 'auto_login' flag in the client-supplied form response, and not checking whether the member is still awaiting admin approval or has been disabled. This makes it possible for unauthenticated attackers who register an account to be logged in without the required admin approval when manual approval is enabled on the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-2713/
- https://plugins.svn.wordpress.org/user-registration/tags/5.3.2/
- https://wordpress.org/plugins/user-registration/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2713/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.