CVE-2026-109871: User Registration & Membership < 5.3.2 - Subscriber+ Payment Bypass via Membership Renewal

Q: Who can exploit this issue?

An authenticated user must already have an active paid membership subscription. The issue allows that user to renew the subscription indefinitely without completing payment.

Q: Are sites using the plugin affected by default?

The vulnerability applies where the plugin is used to manage paid membership subscriptions and an attacker has an active paid subscription. The provided information does not establish whether any particular payment or membership configuration is enabled by default.

Q: What version should be installed to address the issue?

Update User Registration & Membership to version 5.3.2 or later. Versions before 5.3.2 are affected.

Published Nov 11, 2026

Updated

The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying.

Affected Software

1 affected component

WPEverest User Registration & Membership<5.3.2

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An authenticated user must already have an active paid membership subscription. The issue allows that user to renew the subscription indefinitely without completing payment.

Are sites using the plugin affected by default?

The vulnerability applies where the plugin is used to manage paid membership subscriptions and an attacker has an active paid subscription. The provided information does not establish whether any particular payment or membership configuration is enabled by default.

What version should be installed to address the issue?

Update User Registration & Membership to version 5.3.2 or later. Versions before 5.3.2 are affected.

CVE-2026-109871: User Registration & Membership < 5.3.2 - Subscriber+ Payment Bypass via Membership Renewal

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are sites using the plugin affected by default?

What version should be installed to address the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are sites using the plugin affected by default?

What version should be installed to address the issue?