CVE-2026-6203mediumCWE-601

CVE-2026-6203: medium-severity vulnerability in wpeverest User Registration & Membership…

User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter

Published · Updated

Follow this CVE+ Monitor User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 6.1epss 0.7%
The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient validation of user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. The `redirect_to_on_logout` GET parameter is passed directly to WordPress's `wp_redirect()` function instead of the domain-restricted `wp_safe_redirect()`. While `esc_url_raw()` is applied to sanitize malformed URLs, it does not restrict the redirect destination to the local domain, allowing an attacker to craft a specially formed link that redirects users to potentially malicious external URLs after logout, which could be used to facilitate phishing attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
wpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Related CVEs — wpeverest User Registration & Membership…

In the same product, most dangerous first.

CVE-2026-1492CRITICALUser Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership RegistrationEPSS 28.9%CVE-2023-3342CRITICALUser Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.7%CVE-2023-3343HIGHUser Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object InjectionEPSS 1.1%CVE-2024-2417HIGHUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 0.9%CVE-2024-3295MEDIUMUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media DeletionEPSS 0.9%CVE-2024-1720MEDIUMUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site ScriptingEPSS 0.5%