Cross-Site Request Forgery Vulnerability in User Registration & Membership Plugin for WordPress
CVE-2026-92978

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Vendor
CVE Published:
17 October 2026

What is CVE-2026-92978?

The User Registration & Membership plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability due to improper nonce validation in the trigger_bulk_action function. This flaw enables unauthenticated attackers to manipulate site actions, such as approving or denying user registrations, by tricking administrators into clicking crafted links. An attacker can exploit this vulnerability by bypassing nonce checks through a specially crafted request, resulting in unauthorized actions that can lock targeted users out of their accounts.

Affected Version(s)

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 0 <= 5.2.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/user-registrat...
https://plugins.trac.wordpress.org/browser/user-registrat...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonah Burgess (CryptoCat)
.