PT-2026-36994 · WordPress · User Registration & Membership

Hunter Jensen · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-3601

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions User Registration & Membership plugin for WordPress versions prior to 5.1.5

Description A missing capability check in the embed form action() function allows authenticated attackers with Contributor-level access or higher to perform unauthorized modification of data. This flaw enables these users to append shortcode content to arbitrary pages that they do not own or have permission to edit.

Recommendations Update the plugin to version 5.1.5 or later. As a temporary workaround, restrict access to the embed form action() function for users with Contributor-level permissions.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3601

Affected Products

User Registration & Membership

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-3601 · Security Note
• https://plugins.trac.wordpress.org/browser/user-registration/tags/5.1.2/includes/admin/class-ur-admin-assets.php#L370 · Note
• https://twitter.com/CVEnew/status/2051595412226867330 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c8798fb2-4cab-4960-9e32-fd74bb4a5091?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3485702/user-registration/trunk/includes/class-ur-ajax.php?contextall=1 · Note
• https://plugins.trac.wordpress.org/browser/user-registration/tags/5.1.2/includes/class-ur-ajax.php#L1003 · Note
• https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/class-ur-ajax.php#L1003 · Note
• https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/admin/class-ur-admin-assets.php#L370 · Note