A high-severity access control vulnerability in the User Registration & Membership plugin allows unauthenticated users to bypass registration restrictions and create unauthorized accounts.

This is a broken access control vulnerability, classified as CWE-284, where the plugin fails to check if the site administrator has disabled open registrations. The flaw is accessible to unauthenticated remote attackers who can submit registration forms to successfully create new user accounts.

Successful exploitation allows unauthorized users to gain access to the application, which may lead to unauthorized data access or privilege escalation if the created accounts are assigned elevated roles by default. With a CVSS score of 7.5, this vulnerability represents a high risk to organizational security, particularly for sites that rely on strict membership control to protect sensitive user data or proprietary functionality.

Immediate Action: Update the User Registration & Membership plugin to version 5.2.6 or later to enforce registration settings correctly.

Proactive Monitoring: Review WordPress user registration logs for anomalous account creation patterns or unauthorized spikes in new user registrations.

Compensating Controls: If an immediate update is not feasible, consider temporarily deactivating the plugin or implementing a Web Application Firewall rule to block requests to the registration endpoint.

Public Exploit Available: No

Given the ease of exploitation and the potential for unauthorized access, administrators must prioritize updating the plugin to version 5.2.6 immediately. Failure to address this flaw leaves the platform exposed to unauthorized account creation, which could be leveraged for further malicious activity within the WordPress environment.