CVE-2026-16736

7.5 HIGH

Published 2026-08-05 · Updated 2026-08-05

AI risk analysis

Summary: The flaw allows unauthenticated users to bypass registration restrictions set by administrators, enabling account creation even when open registration is disabled.
Exploitability: Exploitation requires access to the WordPress plugin and knowledge of the site's registration settings; relatively easy if an attacker can identify the vulnerable version.
Blast radius: If exploited, it could lead to unauthorized user accounts being created, potentially compromising user data or site integrity.
Prioritized remediation: Update the User Registration & Membership WordPress plugin to version 5.2.6 or later.

auth-bypasswebwordpress

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-284

All references

https://wpscan.com/vulnerability/dc0d63d6-bcd9-4f14-865a-49d254a831a2/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.