# User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Unauthenticated Information Exposure via REST API Comments on Restricted Content

- **ID:** WPSEC-2026-2714
- **Plugin:** User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (`user-registration`), https://wordpress.org/plugins/user-registration/
- **Affected versions:** all versions before 5.3.2
- **Fixed in:** 5.3.2 (Update to 5.3.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/user-registration
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2714/

## Description

The User Registration & Membership plugin for WordPress is vulnerable to Sensitive Information Exposure via the WordPress REST API comments endpoints in all versions up to, and including, 5.3.1. This is due to the content restriction module hiding comments on restricted posts on the front end but not removing them from REST comment responses. This makes it possible for unauthenticated attackers to read comments posted on content restricted to members.

## References

- https://wpsec.com/vuln/WPSEC-2026-2714/
- https://plugins.svn.wordpress.org/user-registration/tags/5.3.2/
- https://wordpress.org/plugins/user-registration/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2714/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.