User Registration & Membership WordPress Plugin: Improper Authorization (CVE-2026-109870)

The User Registration & Membership WordPress plugin (versions before 5.3.2) contains an improper authorization vulnerability (CVE-2026-109870). The plugin fails to verify that a discount coupon is valid for a specific membership plan before processing the order. An unauthenticated attacker can exploit this to bypass payment verification for paid membership plans. Depending on the membership plan configuration, this can lead to unauthorized assignment of membership roles, including administrative access if a plan is mapped to a high-privilege role.

Impact

Successful exploitation allows unauthenticated users to gain paid membership levels without payment. This can result in unauthorized access to restricted content or privilege escalation if the membership plan is configured to grant administrative roles.

Recommendation

• Update the User Registration & Membership WordPress plugin to version 5.3.2 or later immediately.
• Audit existing membership plan role mappings to ensure that elevated roles (e.g., Administrator, Editor) are not assigned to self-registration membership plans.
• Review registration logs for anomalous signup patterns, specifically multiple successful registrations utilizing coupon codes that should be restricted.