User Registration & Membership permits an external post-login redirect
User Registration & Membership versions before 5.2.8 do not validate the destination used after login. An unauthenticated attacker can craft a login flow that sends a visitor to an arbitrary external URL after the visitor interacts with it, enabling a trusted-site redirect into phishing content. The authoritative export does not identify the login route, redirect parameter, or accepted URL encodings.
- Component
- User Registration & Membership
- Plugin slug
user-registration- Affected
- < 5.2.8
- Safe version
5.2.8- Published
- Sep 13, 2026
This CVE was published Sep 13, 2026 and is one of 49 known issues for this plugin.
Update, patch or deactivate.
Update User Registration & Membership to 5.2.8 or later. The application-level fix must allow only local, explicitly permitted post-login destinations, normalize and validate the URL before redirecting, and fall back to a safe site URL when validation fails.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N