CVE-2026-109870

Name of the Vulnerable Software and Affected Versions User Registration & Membership WordPress plugin versions prior to 5.3.2

Description An issue exists where the plugin fails to verify if a discount coupon applied to a paid membership plan is valid for that specific plan. This allows unauthenticated users to apply a coupon that makes the order fully discounted, which the system then treats as paid. Consequently, users can be granted the role associated with a paid plan without payment, potentially leading to privilege escalation to the administrator level if the plan is mapped to a privileged role.

Recommendations Update the User Registration & Membership WordPress plugin to version 5.3.2 or later.