User Registration & Membership lets subscribers obtain paid-plan roles without payment
User Registration & Membership 4.4.6 through versions before 5.2.8 does not check the capability of a user making a membership purchase or validate the submitted payment method and plan. Any authenticated user, including a subscriber, can submit a purchase that grants the WordPress role mapped to a paid plan without paying; a plan mapped to a privileged role can yield administrator access. The authoritative export does not identify the purchase endpoint, action, or parameter names.
- Component
- User Registration & Membership
- Plugin slug
user-registration- Affected
- 4.4.6 to < 5.2.8
- Safe version
5.2.8- Published
- Sep 13, 2026
This CVE was published Sep 13, 2026 and is one of 49 known issues for this plugin.
Update, patch or deactivate.
Update User Registration & Membership to 5.2.8 or later. The application-level fix must authorize membership purchases, bind the selected plan and role to a server-validated payment result, reject caller-controlled payment methods or role mappings, and never grant a role before payment is verified.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H