CVE-2026-1779: fallo de gravedad alta en wpeverest User Registration & Membership…
User Registration & Membership <= 5.1.2 - Authentication Bypass
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.1epss 0.4%
The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
wpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login BuilderCVEs relacionadas — wpeverest User Registration & Membership…
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-1492CRITICALUser Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership RegistrationEPSS 28.9%CVE-2023-3342CRITICALUser Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.7%CVE-2023-3343HIGHUser Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object InjectionEPSS 1.1%CVE-2024-2417HIGHUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 0.9%CVE-2024-3295MEDIUMUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media DeletionEPSS 0.9%CVE-2026-6203MEDIUMUser Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' ParameterEPSS 0.7%