Vulnerabilities / User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder / WPSEC-2026-2715
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Authenticated (Subscriber+) Payment Bypass via Stripe Membership Renewal
Medium 4.3
CWE-345Fixed in 5.3.2
- ID
- WPSEC-2026-2715
- Plugin
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (user-registration)
- Affected
- all versions before 5.3.2
- Remediation
- Update to 5.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-07
- Attack surface
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder on WPSec AttackSurface
- Fix released
- Published
Description
The User Registration & Membership plugin for WordPress is vulnerable to payment verification bypass via the Stripe membership renewal confirmation in all versions up to, and including, 5.3.1. This is due to the payment check accepting any earlier completed order as proof of payment when the request has no PaymentIntent, and to the renewal flag being read from user meta that outlives a discarded renewal order. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a membership, to renew their membership without paying.
References
- https://wpsec.com/vuln/WPSEC-2026-2715/
- https://plugins.svn.wordpress.org/user-registration/tags/5.3.2/
- https://wordpress.org/plugins/user-registration/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS