Description

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-13T06:16:25.260Z",
  "pubdate": "2026-09-13T06:16:25.260Z",
  "executiveSummary": "The User Registration & Membership WordPress plugin before version 5.2.8 is susceptible to an unauthenticated Information Disclosure vulnerability.\nThis flaw arises due to an authorization bypass within the membership confirmation page functionality, which fails to validate user ownership or transaction status.\nAn unauthenticated attacker can retrieve sensitive user information, including email addresses, profile fields, assigned roles, and membership order details.\nThe vulnerability is restricted to environments where the site administrator has configured the membership confirmation page to display user smart tags, as the default configuration does not include these tags.\nThe risk implication is significant as it allows for unauthorized data scraping and reconnaissance of site membership data. Exploitation is trivial for an attacker provided the necessary configuration exists, requiring no specific credentials or elevated privileges to execute.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper access control implementation within the plugin's membership confirmation mechanism. The application fails to perform sufficient server-side validation to verify that the visitor requesting the confirmation page holds the legitimate authority to view the requested membership profile.\nSpecifically, the plugin does not enforce a check on session-based ownership, nor does it verify that a successful registration or financial transaction has occurred for the account identifier specified in the request parameters.\nExploitation is contingent upon the site administrator including user smart tags within the configurable message of the membership confirmation page. When these tags are present, the plugin dynamically renders sensitive user information associated with the requested account.\nThe attack flow follows a predictable pattern: 1) The attacker identifies the membership confirmation page URL. 2) The attacker crafts a request, typically using URL parameters or identifiers that map to specific user accounts. 3) The application, failing to validate the request, queries the backend database for the requested account metadata. 4) The plugin injects the retrieved data (email, profile fields, roles, order details) into the response object due to the inclusion of the smart tags. 5) The attacker receives a plaintext response containing the private user data.\nBecause the plugin does not mandate authentication, the attack is performed entirely over the public network. The scope of information disclosure is limited by the data associated with the user smart tags rendered on that specific page, but the impact includes the exposure of personally identifiable information (PII) and sensitive internal membership details.\nAffected versions include all iterations of the User Registration & Membership plugin prior to 5.2.8. No privilege escalation is required to exploit this, as the endpoint is exposed globally and lacks the necessary authorization logic to restrict access to the resource owner or an administrative entity."
}