CVE-2026-109873: User Registration & Membership < 5.3.2 - Unauthenticated Payment Before Login Bypass via Omitted Membership Field

Q: Which sites are exposed to this bypass?

Sites using a version of the User Registration & Membership WordPress plugin earlier than 5.3.2 are exposed if they use a registration form intended to require payment before a user can log in.

Q: What does an attacker need to do to exploit it?

An unauthenticated attacker submits the affected registration form without selecting a membership. This can create an account that can log in without completing the required payment.

Q: How can administrators determine whether they may already be affected?

Review the installed plugin version and whether payment-gated registration forms allow registration submissions with no membership selected. Versions earlier than 5.3.2 should be treated as affected.

Published Nov 11, 2026

Updated

The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated registration form and log in without completing payment.

Affected Software

1 affected component

WPEverest User Registration & Membership<5.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade User Registration & Membership WordPress plugin to a version that resolves this vulnerability.
Fixed in 5.3.2

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which sites are exposed to this bypass?

Sites using a version of the User Registration & Membership WordPress plugin earlier than 5.3.2 are exposed if they use a registration form intended to require payment before a user can log in.

What does an attacker need to do to exploit it?

An unauthenticated attacker submits the affected registration form without selecting a membership. This can create an account that can log in without completing the required payment.

How can administrators determine whether they may already be affected?

Review the installed plugin version and whether payment-gated registration forms allow registration submissions with no membership selected. Versions earlier than 5.3.2 should be treated as affected.

CVE-2026-109873: User Registration & Membership < 5.3.2 - Unauthenticated Payment Before Login Bypass via Omitted Membership Field

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are exposed to this bypass?

What does an attacker need to do to exploit it?

How can administrators determine whether they may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this bypass?

What does an attacker need to do to exploit it?

How can administrators determine whether they may already be affected?