CVE-2026-92978

Name of the Vulnerable Software and Affected Versions User Registration & Membership versions prior to 5.2.9

Description This issue involves Cross-Site Request Forgery, a flaw where an attacker tricks a victim into performing actions they did not intend to. Unauthenticated attackers can force administrators to approve pending user registrations or deny arbitrary user accounts, potentially locking users out of the site. This occurs because the trigger bulk action() function lacks proper nonce validation. A nonce is a unique token used to ensure that a request was intentionally sent by the user. An attacker can bypass initial checks in trigger query actions() by providing an empty new role parameter, which redirects control to the unprotected trigger bulk action() handler and prevents the system's standard validation from executing.

Recommendations Update the plugin to version 5.2.9 or later.