User Registration permits account creation while registration is disabled
User Registration & Membership before 5.2.6 processes public registration-form submissions without enforcing WordPress's registration-disabled setting. An unauthenticated visitor can therefore create a new account despite the administrator having closed registration. This unscored record received deeper review because it gives unauthenticated callers an account-creation primitive that may become more serious when forms assign elevated or application-specific roles. The CNA does not disclose the form route, action or parameters.
- Component
- User Registration & Membership
- Plugin slug
user-registration- Affected
- < 5.2.6
- Safe version
5.2.6- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 42 known issues for this plugin.
Update, patch or deactivate.
Update User Registration & Membership to 5.2.6 or later. Audit accounts created while registration was intended to be closed and remove unauthorized users or sessions.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N