Description
The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated registration form and log in without completing payment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | User Registration & Membership | < 5.3.2 | 5.3.2 |
References
- https://wpscan.com/vulnerability/4cce0bb5-eb8e-4452-a6d1-6c408344bc7f/ exploit vdb-entry technical-description