User Registration & Membership Plugin Vulnerability Affecting WordPress
CVE-2026-16736
Currently unrated
What is CVE-2026-16736?
The User Registration & Membership plugin for WordPress, prior to version 5.2.6, fails to respect the site's registration-disabled setting during the processing of registration form submissions. This oversight permits unauthenticated users to create new accounts, even if the WordPress administrator has explicitly disabled open registration, thereby posing a significant risk of unauthorized account creation.
Affected Version(s)
User Registration & Membership 0 < 5.2.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.