# CVE-2026-74001: User Registration & Membership Pro authentication bypass

Source: https://junglewise.ai/threats/cve-2026-74001-user-registration-membership-pro-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-74001 · Severity: critical · CVSS 9.8 · Published 2026-08-20

User Registration & Membership Pro is a WordPress plugin that handles user account registration and membership management. An unauthenticated attacker can bypass the login system and gain unauthorized access to user accounts without knowing passwords, potentially allowing account takeover and unauthorized access to customer data or administrative functions.

Vendors: [Unknown](https://junglewise.ai/threats/vendors/unknown).

## Quick answers

**Is CVE-2026-74001 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74001 being exploited in the wild.

**How severe is CVE-2026-74001?** Critical severity, with a CVSS score of 9.8, published 20 August 2026.

**Which products and versions are affected?** Unknown User Registration & Membership Pro <=5.4.5.

**Is there a fix for CVE-2026-74001?** A patch was published on 2026-08-19: Version 5.4.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74001 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-74001?** Check whether you run Unknown User Registration & Membership Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a broken authentication vulnerability (CWE-287) in the User Registration & Membership Pro WordPress plugin affecting versions up to 5.4.5. The vulnerability allows unauthenticated attackers to bypass the login mechanism and authenticate as arbitrary users, likely through a flaw in the authentication validation logic or session handling. No network authentication is required—the attack can be performed remotely by any internet-connected attacker. The vulnerability enables complete account takeover and unauthorized system access. Version 5.4.6 and later contain the fix.

## Affected products

- Unknown User Registration & Membership Pro <=5.4.5

## Timeline

- 2026-08-20: disclosed
- 2026-08-19: patched: Version 5.4.6 released

## References

- [https://patchstack.com/database/wordpress/plugin/user-registration-pro/vulnerability/wordpress-user-registration-membership-pro-plugin-5-4-5-account-takeover-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/user-registration-pro/vulnerability/wordpress-user-registration-membership-pro-plugin-5-4-5-account-takeover-vulnerability?_s_id=cve)