User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

Information

Software Type Plugin
Software Slug user-registration (view on wordpress.org)
Software Status Active
Software Author wpeverest
Software Website wpuserregistration.com
Software Downloads 4,405,450
Software Active Installs 50,000
Software Record Last Updated July 22, 2026

Showing 1-20 of 40 Vulnerabilities

Submit a Vulnerability
User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass
6.5
CVE-2026-1869
Jun 25, 2026
Researcher: Supakiad S. (m3ez)
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 - Missing Authorization
5.3
CVE-2026-52701
Jun 22, 2026
Researcher: nobody09
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.1.2 - Missing Authorization
5.3
CVE-2026-25425
May 28, 2026
Researcher: 0xd4rk5id3
User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter
5.3
CVE-2026-7651
May 27, 2026
Researcher: Supakiad S. (m3ez)
User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
5.3
CVE-2026-6145
May 13, 2026
Researcher: Anthony Cihan (Hann1bl3L3ct3r)
User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification
4.3
CVE-2026-3601
May 4, 2026
Researcher: Hunter Jensen (skid)
User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
6.1
CVE-2026-6203
Apr 13, 2026
Researchers: Anthony Cihan (Hann1bl3L3ct3r), Louis Deschanel (JeanJeanLeHaxor), Pascal SUN
User Registration <= 5.1.5 - Reflected Cross-Site Scripting
6.1
CVE-2026-42652
Apr 9, 2026
Researcher: Raihan Adi Arba
User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]
6.5
CVE-2026-1865
Apr 7, 2026
Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777)
User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation
5.4
CVE-2026-4056
Mar 23, 2026
Researcher: normaandersonfrank
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 4.4.9 - Unauthenticated Remote Code Execution
9.8
CVE-2026-32488
Mar 23, 2026
Researcher: 0xd4rk5id3
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
9.8
CVE-2026-1492
Mar 2, 2026
Researcher: Foxyyy
User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
5.3
CVE-2026-2356
Feb 25, 2026
Researcher: h0xilo
User Registration & Membership <= 5.1.2 - Authentication Bypass
8.1
CVE-2026-1779
Feb 25, 2026
Researcher: 0xd4rk5id3
User Registration <= 4.4.6 - Missing Authorization
5.3
CVE-2025-67956
Jan 21, 2026
Researcher: Mdr
User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion
5.4
CVE-2025-14976
Jan 9, 2026
Researcher: theviper17y
User Registration <= 4.4.9 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
5.4
CVE-2026-24353
Jan 8, 2026
Researcher: Kishan Vyas
User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2025-13367
Dec 15, 2025
Researcher: Muhammad Yudha - DJ
User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection
4.9
CVE-2025-9085
Sep 5, 2025
Researcher: Jack Pas (Dark.)
User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode
6.4
CVE-2025-6831
Jul 21, 2025
Researcher: Muhammad Yudha - DJ
Title Status CVE ID CVSS Researchers Date
User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass Patched CVE-2026-1869 6.5 Supakiad S. (m3ez) June 25, 2026
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 - Missing Authorization Patched CVE-2026-52701 5.3 nobody09 June 22, 2026
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.1.2 - Missing Authorization Patched CVE-2026-25425 5.3 0xd4rk5id3 May 28, 2026
User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter Patched CVE-2026-7651 5.3 Supakiad S. (m3ez) May 27, 2026
User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter Patched CVE-2026-6145 5.3 Anthony Cihan (Hann1bl3L3ct3r) May 13, 2026
User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification Patched CVE-2026-3601 4.3 Hunter Jensen (skid) May 4, 2026
User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter Patched CVE-2026-6203 6.1 Anthony Cihan (Hann1bl3L3ct3r), Louis Deschanel (JeanJeanLeHaxor), Pascal SUN April 13, 2026
User Registration <= 5.1.5 - Reflected Cross-Site Scripting Patched CVE-2026-42652 6.1 Raihan Adi Arba April 9, 2026
User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] Patched CVE-2026-1865 6.5 Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777) April 7, 2026
User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation Patched CVE-2026-4056 5.4 normaandersonfrank March 23, 2026
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 4.4.9 - Unauthenticated Remote Code Execution Patched CVE-2026-32488 9.8 0xd4rk5id3 March 23, 2026
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration Patched CVE-2026-1492 9.8 Foxyyy March 2, 2026
User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion Patched CVE-2026-2356 5.3 h0xilo February 25, 2026
User Registration & Membership <= 5.1.2 - Authentication Bypass Patched CVE-2026-1779 8.1 0xd4rk5id3 February 25, 2026
User Registration <= 4.4.6 - Missing Authorization Patched CVE-2025-67956 5.3 Mdr January 21, 2026
User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion Patched CVE-2025-14976 5.4 theviper17y January 9, 2026
User Registration <= 4.4.9 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Patched CVE-2026-24353 5.4 Kishan Vyas January 8, 2026
User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Patched CVE-2025-13367 6.4 Muhammad Yudha - DJ December 15, 2025
User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection Patched CVE-2025-9085 4.9 Jack Pas (Dark.) September 5, 2025
User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode Patched CVE-2025-6831 6.4 Muhammad Yudha - DJ July 21, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation