# CVE-2026-1869: WPEverest User Registration & Membership payment bypass

Source: https://junglewise.ai/threats/cve-2026-1869-wpeverest-user-registration-membership-payment-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-1869 · Severity: medium · CVSS 6.5 · Published 2026-06-26

A popular WordPress plugin used for managing user registrations and paid memberships contains a security flaw that allows users to bypass payment requirements. By exploiting this issue, an unauthorized individual can activate premium membership features without actually paying for a subscription. This can lead to direct revenue loss and unauthorized access to restricted site content.

Technologies: [WPEverest User Registration](https://junglewise.ai/threats/technologies/user-registration). Vendors: [WPEverest](https://junglewise.ai/threats/vendors/wpeverest).

## Quick answers

**Is CVE-2026-1869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1869 being exploited in the wild.

**How severe is CVE-2026-1869?** Medium severity, with a CVSS score of 6.5, published 26 June 2026.

**Which products and versions are affected?** WPEverest User Registration <= 5.2.0.

**Is there a fix for CVE-2026-1869?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1869 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-1869?** Check whether you run WPEverest User Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The User Registration & Membership plugin for WordPress is vulnerable to missing authorization due to insufficient validation checks in the confirm_payment() function. This flaw allows unauthenticated remote attackers to manipulate the payment confirmation process. By sending a crafted request to the vulnerable function, an attacker can trick the system into marking a transaction as successful without a valid payment. This results in the unauthorized activation of paid membership tiers and access to restricted content. The issue affects all versions up to and including 5.2.0.

## Affected products

- WPEverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.0

## Timeline

- 2026-06-26: disclosed
- 2026-06-26: advisory

## References

- [https://plugins.trac.wordpress.org/changeset/3552000/user-registration](https://plugins.trac.wordpress.org/changeset/3552000/user-registration)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf5b60b-5a4f-4227-97ac-a952019f46d9?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf5b60b-5a4f-4227-97ac-a952019f46d9?source=cve)

## Related threats

- [ThemeGrill User Registration broken access control](https://junglewise.ai/threats/cve-2026-52701-themegrill-user-registration-broken-access-control)
- [ThemeGrill User Registration broken access control](https://junglewise.ai/threats/cve-2026-25425-themegrill-user-registration-broken-access-control)
- [WPEverest User Registration IDOR in media deletion](https://junglewise.ai/threats/cve-2026-7651-wpeverest-user-registration-idor-in-media-deletion)
- [WPEverest User Registration & Membership SQL injection in membership_ids](https://junglewise.ai/threats/cve-2026-1865-wpeverest-user-registration-membership-sql-injection-in-membership)