Executive brief
The User Registration & Membership plugin for WordPress, which manages user sign-ups and account approvals, contains a security flaw that allows new users to bypass administrative approval. By exploiting this vulnerability, an unauthorized person can create an active account on a website without the site owner's permission. This could lead to unauthorized access to restricted areas of the site or the ability to post content without oversight.
Technical details
The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization due to an insecure implementation of the is_admin_creation_process() method. This method incorrectly identifies a request as an administrative action based solely on the presence of the 'action=createuser' parameter in the $_REQUEST superglobal, without verifying the user's identity or capabilities. An unauthenticated attacker can exploit this by including this parameter during the registration process via the fallback submission path, effectively bypassing the mandatory admin approval requirement. This vulnerability affects all versions up to and including 5.1.5; a patch is available in subsequent versions.
Affected products
- WPEverest User Registration & Membership Up to and including 5.1.5
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory