# User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Authenticated (Subscriber+) Payment Bypass via Stripe Membership Renewal

- **ID:** WPSEC-2026-2715
- **Plugin:** User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (`user-registration`), https://wordpress.org/plugins/user-registration/
- **Affected versions:** all versions before 5.3.2
- **Fixed in:** 5.3.2 (Update to 5.3.2 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/user-registration
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2715/

## Description

The User Registration & Membership plugin for WordPress is vulnerable to payment verification bypass via the Stripe membership renewal confirmation in all versions up to, and including, 5.3.1. This is due to the payment check accepting any earlier completed order as proof of payment when the request has no PaymentIntent, and to the renewal flag being read from user meta that outlives a discarded renewal order. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a membership, to renew their membership without paying.

## References

- https://wpsec.com/vuln/WPSEC-2026-2715/
- https://plugins.svn.wordpress.org/user-registration/tags/5.3.2/
- https://wordpress.org/plugins/user-registration/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2715/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.