{
 "id": "WPSEC-2026-2714",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2714/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2714/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2714/index.md",
 "title": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Unauthenticated Information Exposure via REST API Comments on Restricted Content",
 "description": "The User Registration & Membership plugin for WordPress is vulnerable to Sensitive Information Exposure via the WordPress REST API comments endpoints in all versions up to, and including, 5.3.1. This is due to the content restriction module hiding comments on restricted posts on the front end but not removing them from REST comment responses. This makes it possible for unauthenticated attackers to read comments posted on content restricted to members.",
 "plugin": {
  "slug": "user-registration",
  "name": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder",
  "full_name": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder",
  "wordpress_org": "https://wordpress.org/plugins/user-registration/",
  "advisories_url": "https://wpsec.com/vuln/plugin/user-registration/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/user-registration"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.2",
 "remediation": "Update to 5.3.2 or later.",
 "fix_released": "2026-11-06T11:46:22+00:00",
 "published": "2026-11-07T12:41:15+00:00",
 "updated": "2026-11-07T11:11:19.674580+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2714/",
  "https://plugins.svn.wordpress.org/user-registration/tags/5.3.2/",
  "https://wordpress.org/plugins/user-registration/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/user-registration",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-07"
 }
}