What the vulnerability does
01Description
The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5. This is due to the is_admin_creation_process() method relying solely on the presence of action=createuser in the $_REQUEST superglobal without performing any authentication or capability check. This makes it possible for unauthenticated attackers to bypass the admin approval requirement when registering new accounts via the fallback submission path.
Explanation of Vulnerability in Simple Terms
02Summary
User Registration & Membership plugin for WordPress versions 5.1.5 and earlier lacks proper authorization checks on certain operations. An attacker without authentication can modify data on the site. The vulnerability requires no user interaction and is remotely exploitable over the network.
What an attacker can do
03Attacker Capabilities
Modify site data without logging in.
Potential impact on your site
04Site Impact
Unauthorized users can alter content or settings, potentially affecting site integrity and user trust.
Conditions required to exploit
05Prerequisites
Network access to the WordPress site; no authentication required.
Key dates
06Disclosure timeline
May 14, 2026
CVE published
May 14, 2026
Record updated
