WordPress Plugin Vulnerabilities

User Registration & Membership < 5.3.2 - Subscriber+ Payment Bypass via Membership Renewal

Description

The plugin does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying.

Proof of Concept

Affects Plugins

Fixed in 5.3.2

References

Classification

Type
ACCESS CONTROLS
CWE

Miscellaneous

Original Researcher
Wai Linn Oo
Submitter
Wai Linn Oo
Verified
Yes

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-09 (about 1 day ago)

Other