CVE-2026-11964
Description
The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
Metadata
Severity & Metrics
No CVSS data available.
Affected products (1)
| Vendor | Product | Platform | Versions |
|---|---|---|---|
| Unknown | User Registration & Membership | — | 0 < 5.2.2 |
Weakness (CWE)
| CWE | Source | Description |
|---|---|---|
| — | cna | CWE-287 Improper Authentication |