Description
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | User Registration & Membership | < 5.2.6 | 5.2.6 |
References
- https://wpscan.com/vulnerability/dc0d63d6-bcd9-4f14-865a-49d254a831a2/ exploit vdb-entry technical-description