{
 "id": "WPSEC-2026-2715",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2715/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2715/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2715/index.md",
 "title": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Authenticated (Subscriber+) Payment Bypass via Stripe Membership Renewal",
 "description": "The User Registration & Membership plugin for WordPress is vulnerable to payment verification bypass via the Stripe membership renewal confirmation in all versions up to, and including, 5.3.1. This is due to the payment check accepting any earlier completed order as proof of payment when the request has no PaymentIntent, and to the renewal flag being read from user meta that outlives a discarded renewal order. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a membership, to renew their membership without paying.",
 "plugin": {
  "slug": "user-registration",
  "name": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder",
  "full_name": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder",
  "wordpress_org": "https://wordpress.org/plugins/user-registration/",
  "advisories_url": "https://wpsec.com/vuln/plugin/user-registration/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/user-registration"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.2",
 "remediation": "Update to 5.3.2 or later.",
 "fix_released": "2026-11-06T11:46:22+00:00",
 "published": "2026-11-07T12:41:15+00:00",
 "updated": "2026-11-07T11:11:19.674580+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2715/",
  "https://plugins.svn.wordpress.org/user-registration/tags/5.3.2/",
  "https://wordpress.org/plugins/user-registration/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/user-registration",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-07"
 }
}