WordPress Plugin Vulnerabilities

User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled

Description

The plugin does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.

Proof of Concept

Affects Plugins

Plugin icon
user-registration
Fixed in 5.2.6

References

CVE
CVE-2026-16736
URL
https://wordpress.org/plugins/user-registration/

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Nguyễn Đức Hòa
Submitter
Nguyễn Đức Hòa
Verified
Yes
WPVDB ID
dc0d63d6-bcd9-4f14-865a-49d254a831a2

Timeline

Publicly Published
2026-07-27 (about 9 days ago)
Added
2026-07-27 (about 8 days ago)
Last Updated
2026-07-27 (about 8 days ago)

Other

Published
Title
Published
2026-07-17
Title
Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions
Published
2025-01-16
Title
WP Hotel Booking < 2.1.6 - Missing Authorization
Published
2021-10-06
Title
Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming
Published
2022-05-18
Title
Jupiter < 6.10.2 & JupiterX Core < 2.0.8 - Subscriber+ Privilege Escalation and Post Deletion
Published
2024-02-19
Title
Schema & Structured Data for WP & AMP < 1.27 - Contributor+ reCaptcha Key Update