Description
The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | User Registration & Membership | < 5.3.2 | 5.3.2 |
References
- https://wpscan.com/vulnerability/444889b1-ae92-45b6-a13b-e76a5fa7ce58/ exploit vdb-entry technical-description