CVE-2026-80072: User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters
Published Sep 13, 2026
·Updated
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.
Affected Software
1 affected component
WordPress plugin "User Registration & Membership"<5.2.8
Event History
Sep 13, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Which installations are affected?
WordPress sites using User Registration & Membership versions earlier than 5.2.8 are affected.
2
Does an attacker need an account to exploit this issue?
No. The issue can be exploited by unauthenticated attackers.
3
What is the practical impact of successful exploitation?
An attacker can cause visitors to be redirected to an arbitrary external URL after login, which may be used in phishing attacks.