User Registration & Membership Plugin Pre-Auth Payment Bypass Vulnerability CVE-2026-1869

Vulnerability Overview Vulnerability Name: User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass CVE ID: CVE-2026-1869 CVSS Score: 6.5 (Medium) Publication Date: June 25, 2026 Last Updated: June 26, 2026 Researchers: Supakiat S. (m3er) - E-CURITY (Thailand) Impact Scope Software Type: Plugin Software Name: User Registration & Membership - Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Affected Versions: <= 5.2.0 Fixed Version: 5.2.1 Remediation Remediation Recommendation: Update to version 5.2.1 or higher. Vulnerability Description This vulnerability allows unauthenticated attackers to bypass payment processing and activate paid memberships. Specifically, the User Registration & Membership plugin in version 5.2.0 and earlier contains an issue regarding unauthorized data modification, which allows attackers to bypass the payment flow. References plugins.trac.wordpress.org Additional Information Sharing Options: Share buttons are provided for Facebook, Twitter, LinkedIn, and Email. Related Vulnerabilities: The page lists multiple other vulnerabilities related to the User Registration & Membership plugin, including CVE ID, CVSS score, researchers, and publication dates. Disclaimer This record contains copyrighted material, owned by Defiant Inc. and MITRE Corporation. Contact Information For any questions or further information, please contact wfi-support@wordfence.com. Business Hours Business hours are 9 am - 8 pm ET, 6 am - 5 pm PT, and 2 pm - 1 am UTC/GMT, excluding weekends and holidays. 24/7 customer support with a 1-hour response time. Other Links Links to Terms of Service, Privacy Policy and Notifications, Do Not Sell or Share My Personal Information, etc. Social Media Links to X, Facebook, LinkedIn, and Instagram social media profiles. Products and Support Options for products and support are provided, including Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, and Wordfence Central. News and About Information is provided regarding the Blog, News, Vulnerability Advisory, About Wordfence, Affiliate Program, Careers, Contact, Security, and CVE Request Form. Subscribe for Updates Options to subscribe to news and updates are provided, requiring an email address and agreement to the Terms of Service and Privacy Policy. Copyright Information Copyright © 2012-2026 Defiant Inc. All rights reserved. Other The Wordfence Intelligence logo and the word “CREATIVE” appear at the bottom of the page.

Goal Reached Thanks to every supporter — we hit 100%!

User Registration & Membership Plugin Pre-Auth Payment Bypass Vulnerability CVE-2026-1869

More from this source