Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-16736

User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled

Description

The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown User Registration & Membership

Default version status: unaffected

  • 0 to < 5.2.6affected

References