User Registration & Membership Plugin for WordPress Vulnerability Exposes User Data
CVE-2026-86407

Currently unrated

Key Information:

Vendor

WordPress
Status
User Registration & Membership
Vendor
CVE Published:
13 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-86407?

The User Registration & Membership Plugin for WordPress prior to version 5.2.8 suffers from an improper access control vulnerability. This flaw allows unauthenticated users to access sensitive information, such as email addresses and membership details, related to other users. Specifically, if a site owner has implemented a user smart tag in the membership confirmation message, unauthorized users can exploit this weakness to reveal user profiles without needing any authentication. The default configuration of the plugin does not utilize this tag, but once added, it poses a significant risk if not properly secured.

Affected Version(s)

User Registration & Membership 5.0 < 5.2.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86407 - Proof of Concept

References

https://wpscan.com/vulnerability/2c9eb1fe-4e18-4fd0-9581-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karthik Ramakrishnan
WPScan
.