Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

WordPress User Registration & Membership Plugin Payment Webhook Security Risk

CVE-2026-11964 · published 3 months ago
Summary

The User Registration & Membership WordPress plugin, used in WordPress websites, has a security issue that could allow attackers to activate paid memberships without making a real payment. This could lead to unauthorized access to premium content or services. Update the plugin to version 5.2.2 or later to fix this issue.

Original advisory text
The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated...
The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Timeline
Published13 Jul 2026
Updated4 Nov 2026
First seen13 Jul 2026
Sources
CVE-2026-11964 · NVD
Track software like this
Free during beta