{"id":"CVE-2026-1779","aliases":["EUVD-2026-8824","GHSA-xm8p-wgjh-pfxf"],"status":"published","title":"User Registration \u0026 Membership \u003c= 5.1.2 - Authentication Bypass","description":"The User Registration \u0026 Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00406,"percentile":0.35379,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-288"],"published":"2026-02-26T02:23:56Z","modified":"2026-06-17T10:16:30Z","products":[{"vendor":"wpeverest","product":"user registration \u0026 membership – free \u0026 paid memberships, subscriptions, content restriction, user profile, custom user registration \u0026 login builder"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d99bc021-ba9e-4294-8dd2-c25bc8007d05?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/user-registration/tags/5.0.4/modules/membership/includes/AJAX.php#L246"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1779"},{"url":"https://github.com/advisories/GHSA-xm8p-wgjh-pfxf"}],"sources":{"cve":[{"id":"CVE-2026-1779","title":"User Registration \u0026 Membership \u003c= 5.1.2 - Authentication Bypass","description":"The User Registration \u0026 Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.","status":"published","published":"2026-02-26T02:23:56.402Z","modified":"2026-04-08T17:27:10.385Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:20:01.271368Z"}],"euvd":[{"id":"EUVD-2026-8824","description":"The User Registration \u0026 Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.","status":"published","published":"2026-02-26T02:23:56Z","modified":"2026-04-08T17:27:10Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:37.761544Z"}],"ghsa":[{"id":"GHSA-xm8p-wgjh-pfxf","title":"The User Registration \u0026 Membership plugin for WordPress is vulnerable to authentication bypass in...","description":"The User Registration \u0026 Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.","status":"published","published":"2026-02-26T03:31:18Z","modified":"2026-02-26T03:31:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:06:23.326773Z"}],"nvd":[{"id":"CVE-2026-1779","description":"The User Registration \u0026 Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.","status":"published","published":"2026-02-26T03:16:03.827Z","modified":"2026-06-17T10:16:30.41Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:12:07.027269Z"}]}}