CVE-2026-109871 | BDVDB-2026-404765 Detail

User Registration & Membership

Description#

The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-284 Improper Access Control

References#

https://wpscan.com/vulnerability/444889b1-ae92-45b6-a13b-e76a5fa7ce58/

Exploit#

https://wpscan.com/vulnerability/444889b1-ae92-45b6-a13b-e76a5fa7ce58/

History#

Version 12026-11-11Record published in the CVE List.