PT-2026-40894 · WordPress · User Registration & Membership

Anthony Cihan · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-6145

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions User Registration & Membership plugin for WordPress versions prior to 5.1.6

Description An issue exists where the is admin creation process() function relies exclusively on the presence of the action=createuser parameter within the $ REQUEST superglobal without verifying authentication or user capabilities. This allows unauthenticated attackers to bypass the administrative approval requirement during the account registration process via the fallback submission path.

Recommendations Update the plugin to a version later than 5.1.5. As a temporary workaround, restrict access to the registration fallback submission path to minimize the risk of unauthorized account creation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-6145

Affected Products

User Registration & Membership

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-6145 · Security Note
• https://t.me/cveNotify/163417 · Telegram Post
• https://t.me/CVEtracker/53765 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b6b349f2-24c9-4921-bb5f-a7726ebc5c2a?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3516468/user-registration/trunk/includes/class-ur-user-approval.php · Note
• https://twitter.com/VulmonFeeds/status/2054878225000444097 · Twitter Post