CVE-2026-92978

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger bulk action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger query actions() by supplying an empty new role parameter, which causes that handler to return early and cede control to the unprotected trigger bulk action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.