CVE-2026-11965

Name of the Vulnerable Software and Affected Versions User Registration & Membership versions prior to 5.2.0

Description The plugin fails to enforce payment completion before activating paid membership subscriptions. This allows unauthenticated users who self-register through the open registration flow to obtain an active subscription to any paid plan without payment, granting them unauthorized access to gated content.

Recommendations Update the plugin to version 5.2.0 or later.