CVE-2026-92978: User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the triggerbulkaction function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in triggerqueryactions() by supplying an empty newrole parameter, which causes that handler to return early and cede control to the unprotected triggerbulkaction() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
WordPress sites using WPEverest User Registration & Membership version 5.2.8 or earlier are affected. Exploitation specifically requires an administrator to be logged in and to perform an attacker-influenced action, such as clicking a forged link.
What can an attacker do if exploitation succeeds?
An attacker can cause an administrator to approve pending user registrations or deny arbitrary user accounts. Denying an account can lock the targeted user out of the site.
Does the attacker need an account or administrator credentials?
No. The vulnerability can be exploited by an unauthenticated attacker, but the attacker must persuade a logged-in site administrator to interact with a forged request.
How does the CSRF protection get bypassed?
The attacker can provide an empty new_role parameter, causing trigger_query_actions() to return before its nonce check protects the request. Processing then reaches trigger_bulk_action(), which lacks effective nonce validation, and its exit() prevents WordPress core's bulk-user nonce validation from running.