User Registration & Membership confirmation pages can expose another user's profile
User Registration & Membership 5.0 through versions before 5.2.8 do not verify that a visitor requesting a membership confirmation page owns the named account or completed a registration or purchase. An unauthenticated caller can retrieve another user's email address, profile fields, role, and membership order details when the site owner has added a user smart tag to the page's configurable message; the shipped default message does not include that tag. The authoritative export does not identify the route, account selector, smart-tag syntax, or exposed field set.
- Component
- User Registration & Membership
- Plugin slug
user-registration- Affected
- 5.0 to < 5.2.8
- Safe version
5.2.8- Published
- Sep 13, 2026
This CVE was published Sep 13, 2026 and is one of 49 known issues for this plugin.
Update, patch or deactivate.
Update User Registration & Membership to 5.2.8 or later. Until updated, remove user smart tags from public confirmation messages. The application-level fix must bind confirmation data to the current registration or purchase session, verify ownership of the requested account, and avoid rendering private user fields to unauthenticated visitors.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N